1016 matches found
Viessmann Vitogate 300 - Hardcoded Password
A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface. id: CVE-2023-5222 info: name: Viessmann Vitogate 300 - Hardcoded Password author: ritikchaddha severity: critical description: | A critica...
CVE-2026-58796
In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...
CVE-2026-58796
Multiple functions within AndroidManifest.xml on Android are vulnerable to unauthorized firmware updates because of a missing permission check on exported broadcast receivers. This flaw allows for local escalation of privilege without requiring additional execution privileges or user interaction....
EUVD-2026-122783
In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...
PT-2026-144516
In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...
Symmetricom SyncServer Unauthenticated - Remote Command Execution
Microchip Technology Microsemi SyncServer S650 was discovered to contain a command injection vulnerability. id: CVE-2022-40022 info: name: Symmetricom SyncServer Unauthenticated - Remote Command Execution author: DhiyaneshDK,mielverkerken severity: critical description: | Microchip Technology...
PUB-A-512068588
In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...
TOTOLINK X2000R encryption vulnerability
The TOTOLINK X2000R has an encryption vulnerability. This vulnerability arises from the boa firmware update feature, which does not verify the firmware signature. Attackers can upload specially crafted firmware binary files through authenticated HTTP requests, resulting in arbitrary firmware...
CVE-2026-105036 EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.120260617182218release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...
EnergizeLab AI Station software supply chain vulnerability issues
EnergizeLab AI Station has a software supply chain vulnerability. This vulnerability stems from downloading firmware updates via plaintext HTTP, without verifying their integrity and authenticity. This could allow attackers to replace malicious updates by intercepting or modifying traffic...
EUVD-2026-80386
The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel...
How to secure edge AI in customer-owned environments
In this article 1. Edge AI changes the trust model for AI systems 2. Constrain model actions through deterministic mediation 3. Establish trust before releasing sensitive assets 4. Verify runtime before releasing sensitive assets 5. Verify artifacts that shape model behavior 6. Next steps Edge AI...
"Am I Just That Dumb?": Applicability, Action and Verification in Consumer IoT Security Advice
Public campaigns urge people to change default passwords on Internet of Things IoT devices and keep them updated, assuming users can independently determine whether the advice applies. We gave 28 participants in the Netherlands two pieces of government-issued advice reflecting guidance in several...
EUVD-2026-53349
WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...
CVE-2026-71264 WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State
WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...
Android Automotive OS Update Bulletin—August 2026Stay organized with collectionsSave and categorize content based on your preferences.
The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2026-08-05 or later from the August 2026 Android Security Bulletin in addition to all issues in this...
EUVD-2026-51038
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...
CVE-2026-44103 JupiCore does not perform validation of firmware
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...
CVE-2026-44103
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...
PT-2026-66431
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...