4764 matches found
CVE-2022-36385 Contec Health CMS8000
A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a...
CVE-2022-36385
CVE-2022-36385 affects Contec Health CMS8000 family (CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor). The vulnerability arises from improper access controls that permit a threat actor with momentary physical access to insert a USB drive and perform a malicious firmware update, causing permane...
CVE-2022-36385 Contec Health CMS8000
A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a...
Multi-Vendor BIOS Security Vulnerabilities (September 2022) - Lenovo Support US
No description provided...
PT-2022-23344 · Cms8000 · Cms8000
Name of the Vulnerable Software and Affected Versions: CMS8000 affected versions not specified Description: A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication...
Honeywell SoftMaster
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: SoftMaster Vulnerabilities: Uncontrolled Search Path Element, Incorrect Permission Assignment for Critical Resource. 2. RISK EVALUATION Successful exploitation of these...
Multiple vulnerabilities in Contec FLEXLAN FX3000 and FX2000 series
Overview FLEXLAN FX3000 and FX2000 series provided by Contec Co., Ltd. contain multiple vulnerabilities listed below. Hidden Functionality CWE-912 - CVE-2022-36158 Use of Hard-coded Credentials CWE-798 - CVE-2022-36159 Thomas J. Knudsen and Samy Younsi of Necrum Security Labs reported these...
Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor 访问控制错误漏洞
The Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor is a vital signs patient monitor from Contec Health. The Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor suffers from an Access Control Error vulnerability that originates from a threat actor with transient acce...
Multiple vulnerabilities in CentreCOM AR260S V2
Overview CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities listed below. OS command injection vulnerability in GUI setting page CWE-78 - CVE-2022-35273 Use of hard-coded credentials for the telnet server CWE-798 - CVE-2022-38394 Undocumented hidden command that...
PT-2022-4624 · Centrecom · Centrecom Ar260S V2
Name of the Vulnerable Software and Affected Versions: CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 Description: The issue is related to the use of hard-coded credentials for the telnet server, allowing a remote unauthenticated attacker to execute an arbitrary OS command. This could...
JVN#45473612: Multiple vulnerabilities in CentreCOM AR260S V2
CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities listed below. OS command injection vulnerability in GUI setting page CWE-78 - CVE-2022-35273 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2|...
Vulnerabilities fixed in SonicWall SMA100
Sonicwall has fixed two vulnerabilities in the firmware of SMA100 systems. An authenticated malicious person can exploit the exploit the vulnerabilities to cause a denial-of-service, or to gain access to system data. The vulnerability that could lead to access to system data has not been assigned...
Thousands of Hikvision video cameras remain unpatched and vulnerable to takeover
In September 2021 we told you about insecure Hikvision security cameras that were ready to be taken over remotely. However, according to a whitepaper published by CYFIRMA, tens of thousands of systems used by 2,300 organizations across 100 countries have still not applied the security update, and...
PLANEX MZK-DP150N contains hidden administrative functionality
Overview MZK-DP150N provided by PLANEX COMMUNICATIONS INC. contains a hidden administrative screen CVE-2021-37289, CWE-912. In the initial settings of the product, the login account for the configuration screen is common to all products. Please change the account information from the initial...
UNIMO Technology digital video recorders vulnerable to missing authentication for critical functions
Overview Multiple digital video recorders provided by UNIMO Technology Co., Ltd do not perform authentication for some critical functions CWE-306 in the device management web interface. The reporter states that attacks exploiting this vulnerability have been observed. Yoshiki Mori, Ushimaru Hayat...
Certain HP PageWide Pro printers - Potential denial of service
Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack. HP has provided firmware updates for potentially affected products listed in the table below...
PT-2022-22179 · Intel · Intel Nuc Laptop Kits
Name of the Vulnerable Software and Affected Versions: IntelR NUC Laptop Kits versions prior to BC0076 Description: The issue is related to improper buffer restrictions in the firmware, which may allow a privileged user to potentially enable escalation of privilege via local access...
PT-2022-21384 · Intel · Intel Nuc Laptop Kits
Name of the Vulnerable Software and Affected Versions: IntelR NUC Laptop Kits versions prior to BC0076 Description: The issue is related to improper initialization in the firmware, which may allow a privileged user with physical access to potentially enable escalation of privilege. Recommendation...
PT-2022-21745 · Intel · Intel Nuc Laptop Kits
Name of the Vulnerable Software and Affected Versions: IntelR NUC Laptop Kits versions prior to BC0076 Description: The issue is related to improper input validation in the firmware, which may allow a privileged user to potentially enable escalation of privilege via local access. Recommendations:...
