Siemens Desigo PXC (Update C)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

D-Link DIR8xx Router Firmware Upload Vulnerability

Exploit for hardware platform in category web applications !/bin/bash If you have access to an ethernet port you can upload custom firmware to a device because system recovery service is started and available for a few seconds after restart. E-DB Note:...

D-Link DIR-8xx Routers - Local Firmware Upload

D-Link DIR-8xx Routers - Local Firmware Upload !/bin/bash If you have access to an ethernet port you can upload custom firmware to a device because system recovery service is started and available for a few seconds after restart. E-DB Note:...

D-Link DIR-8xx Routers - Local Firmware Upload

!/bin/bash If you have access to an ethernet port you can upload custom firmware to a device because system recovery service is started and available for a few seconds after restart. E-DB Note: https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin E-...

Motorola MX011ANM File Upload Vulnerability

The Motorola MX011ANM is an Internet set-top box device from Motorola, U.S.A. The Xfinity XR11-20 Voice Remote is a voice remote control device.Comcast is a set of firmware developed by Comcast, U.S.A., that runs in devices such as gateways and modems. . A security vulnerability in the Comcast...

Cross site request forgery (csrf)

On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials CSRF. An attacker can host a page that sends a POST...

CVE-2017-7404

On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials CSRF. An attacker can host a page that sends a POST...

CVE-2017-7404

The CVE references a CSRF vulnerability in the Web Interface of the D-Link DIR-615 (pre‑v20.12PTb04). Attackers can lure a logged‑in user to a malicious page which sends a POST to Form2File.htm, uploading firmware without credentials and potentially rebooting/crashing the device (DoS) or enabling...

CVE-2016-8344

CVE-2016-8344 affects Honeywell Experion PKS (Release 3xx and prior; 400, 410, 430, 431) where input is not properly validated. A specially crafted packet could cause the process to terminate, and a successful exploit would prevent firmware uploads to Series-C devices. Exploitation is listed as r...

Honeywell Experion PKS Improper Input Validation Vulnerability

OVERVIEW Honeywell reported a denial-of-service condition caused by an improper input validation vulnerability in Honeywell’s Experion Process Knowledge System PKS platform. Honeywell has produced patches to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

IRZ RUH2 Design Vulnerability

IRZ RUH2 is a serial-to-network connector system from the Russian company IRZ. A security vulnerability exists in the iRZ RUH2. A remote attacker could exploit the vulnerability to upload firmware with an unavailable patch...

CVE-2015-7925

Cross-site request forgery CSRF vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot...

Rockwell Automation ControlLogix 固件上传漏洞

设备不正确验证用户，允许远程用户上传新的固件映像到Ethernet卡上，并且没有检查此固件映像是否合法或破坏，允许攻击者利用漏洞获得对设备的控制或使设备崩溃。...

CVE-2014-0327

The Terminal Upgrade Tool in the Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321...

Code injection

The Terminal Upgrade Tool in the Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321...

CVE-2014-0327

CVE-2014-0327 affects Iridium Pilot BDE and OpenPort on Iridium terminals. The vulnerability stems from an unauthenticated firmware upgrade tool accessible via TCP port 54321, allowing remote attackers to upload firmware and execute arbitrary code, potentially gaining privileged access. Publicly,...

CVE-2014-2969

NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account, which allows remote attackers to upload firmware or read or modify memory contents, and consequently execute arbitrary code, via a request to 1 produceburn.cgi, 2...

Western Digital Arkeia Appliance 10.0.10 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Western Digital Arkeia Appliance v10.0.10 Date: Sep 17 2013 Exploit Author: xistence xistenceat0x90.nl Vendor Homepage: www.arkeia.com Tested on: Virtual Appliance - ESXi 5.1 Affected Version : v10.0.10 and lower Link:...

Western Digital Arkeia Appliance 10.0.10 - Multiple Vulnerabilities

Exploit for php platform in category web applications Arkeia Appliance v10.0.10 is prone to 2 security vulnerabilties: 1 Unauthenticated firmware upload There are no restrictions when a POST request is send to http:///scripts/upload.php thus allowing any unauthenticated client to upload any data ...