CVE-2023-47166

A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability...

CVE-2023-47166

A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability...

PT-2024-3515

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 6800 versions affected versions not specified Cisco IP Phone 7800 versions affected versions not specified Cisco IP Phone 8800 versions affected versions not specified Cisco Video Phone 8875 versions affected versions not...

Milesight UR32L 授权问题漏洞

Milesight UR32L is a 4G industrial router from China's StarZone IOT Milesight. An authorization issue vulnerability exists in Milesight UR32L v32.3.0.7-r2, which stems from a firmware update vulnerability in the file import function, where a specially crafted network request could result in an...

PT-2024-13420 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.7-r2 Description: A firmware update vulnerability exists in the luci2-io file-import functionality. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network reque...

PT-2024-3514

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 6800 versions affected versions not specified Cisco IP Phone 7800 versions affected versions not specified Cisco IP Phone 8800 versions affected versions not specified Cisco Video Phone 8875 versions affected versions not...

Milesight UR32L luci2-io file-import firmware update vulnerability

Talos Vulnerability Report TALOS-2023-1852 Milesight UR32L luci2-io file-import firmware update vulnerability May 1, 2024 CVE Number CVE-2023-47166 SUMMARY A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network...

PT-2024-21304

Name of the Vulnerable Software and Affected Versions RTU500 affected versions not specified Description A vulnerability exists in the RTU500 that allows authenticated and authorized users to bypass secure update. If a malicious actor successfully exploits this vulnerability, they could use it to...

PT-2024-15859 · Grandstream · Grandstream Ucm Series Ip Pbx

Name of the Vulnerable Software and Affected Versions: Grandstream UCM Series IP PBX versions prior to 1.0.20.52 Description: The issue is related to a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP...

NETGEAR routers vulnerable to buffer overflow

Overview Multiple routers provided by NETGEAR Inc. contain a buffer overflow vulnerability CWE-121, CVE-2023-27368. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact An unauthenticated attacker may bypass authentication for th...

HPESBST04635 rev.1 - HPE SAN Switches with Brocade Fabric OS (FOS), Multiple Remote and Local Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE B-series SN2600B SAN Extension Switch - Prior to v9.2.1, v9.2.0b and v9.1.1d HPE B-series SN3600B Fibre Channel Switch - Prior to v9.2.1...

Multiple vulnerabilities in RoamWiFi R10

Overview RoamWiFi R10 provided by RoamWiFi Technology Co., Ltd. contains multiple vulnerabilities listed below. Active debug code CWE-489 - CVE-2024-31406 Insertion of sensitive information into log file CWE-532 - CVE-2024-32051 Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities...

Proscend Communications M330-W and M330-W5 vulnerable to OS command injection

Overview M330-W and M330-W5 provided by Proscend Communications Inc. are LTE Industrial Cellular Routers. M330-W and M330-W5 contain an OS command injection vulnerability CWE-78. CYNEX Analysis Team of National Institute of Information and Communications Technology reported this vulnerability to...

PT-2024-5065 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 1.0.1.25633 Description: A critical issue affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The...

Multiple vulnerabilities in BUFFALO wireless LAN routers

Overview Multiple wireless LAN routers provided by BUFFALO INC. contain multiple vulnerabilities listed below. Plaintext storage of a password CWE-256 OS Command Injection CWE-78 Satoru Nagaoka of Cyber Defense Institute, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the...

HPESBHF04632 rev.3 - HPE Compute Scale-up Server 3200, Superdome Flex and Superdome Flex 280 servers, Local Buffer Overflow

Potential Security Impact: Local: Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.20.128 HPE Superdome Flex 280 Server - Prior to v1.80.20 HPE Superdome Flex Server - Prior to v3.100.26 CVSS Scores: | CVE | CVSS Vector...

JVN#58236836: Multiple vulnerabilities in BUFFALO wireless LAN routers

Multiple wireless LAN routers provided by BUFFALO INC. contain multiple vulnerabilities listed below. Plaintext storage of a password CWE-256 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Base Score 6.5 CVE-2024-23486 OS Command Injection CWE-78 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base...

JVN#82074338: Multiple vulnerabilities in NEC Aterm series

Aterm series provided by NEC Corporation contains multiple vulnerabilities listed below. Incorrect Permission Assignment for Critical Resource CWE-732 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.0 CVE-2024-28005 Exposure of Sensitive System Information to an Unauthorized Control...

PT-2024-21010 · Elecom · Wmc-X1800Gst-B +2

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers versions prior to v1.25 WRC-G01-W versions prior to v1.24 WMC-X1800GST-B versions prior to v1.41 Description: The issue allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending...

Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 Use of Hard-Coded Credentials (CVE-2017-12709)

A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device. This plugin only...