Design/Logic Flaw

A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle MitM attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later...

CVE-2021-22909

EdgeMAX EdgeRouter exposes a vulnerability (CVE-2021-22909) in V2.0.9 and earlier that can enable a man-in-the-middle attack during firmware updates. Red Hat and NVD entries align on the affected product range and the update process risk. The issue is resolved in EdgeRouter V2.0.9-hotfix.1 and la...

CVE-2021-22909

A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle MitM attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later...

CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints Vulnerability

Three API endpoints for the IoT Controller are accessible without authentication. Two of the endpoints result in information leakage and consumption of computing/storage resources. The third API endpoint that does not require authentication allows for a factory reset of the IoT Controller...

CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed Vulnerability

CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed Vulnerability 1. Vulnerability Details Affected Vendor: CommScope Affected Product: Ruckus IoT Controller Affected Version: 1.7.1.0 and earlier Platform: Linux CWE Classification: CWE-798: Use of Hard-coded Credentials CVE ID:...

CommScope Ruckus IoT Controller Hard-coded System Passwords

Vulnerability Details Affected Vendor: CommScope Affected Product: Ruckus IoT Controller Affected Version: 1.7.1.0 and earlier Platform: Linux CWE Classification: CWE-259: Use of Hard-coded Password CVE ID: CVE-2021-33218 2. Vulnerability Description Hard coded, system-level credentials exist on...

CommScope Ruckus IoT Controller Undocumented Account

Vulnerability Details Affected Vendor: CommScope Affected Product: Ruckus IoT Controller Affected Version: 1.7.1.0 and earlier Platform: Linux CWE Classification: CWE-798: Use of Hard-coded Credentials, CWE-912: Hidden Functionality CVE ID: CVE-2021-33216 2. Vulnerability Description An upgrade...

Security Bulletin: This Power System update is being released to address CVE-2021-20487

Summary Power9: A new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2021-20487. The Self Boot EngineSBE can be compromised from the service processor to allow injection of malicious code. An attacker that gains root access to the...

CVE-2020-24395

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

CVE-2020-24395

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

Input validation

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

CVE-2020-24395

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

CVE-2020-24395

The CVE-2020-24395 issue affects homee Brain Cube v2 (firmware versions 2.28.2 and 2.28.4). Affected component: USB firmware update script. Root cause: insufficient validation of the firmware image file, enabling an attacker with physical access to install compromised firmware and potentially ach...

Ubiquiti Networks EdgeOS Improper Certificate Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ubiquiti Networks EdgeOS on EdgeRouter X, EdgeRouter Pro X SFP, EdgeRouter 10X and EdgePoint 6-port routers. User interaction is required to exploit this vulnerability in that an administrator must...

PT-2021-15266 · Ubiquiti · Edgemax Edgerouter

Name of the Vulnerable Software and Affected Versions: EdgeMAX EdgeRouter versions prior to V2.0.9-hotfix.1 Description: A vulnerability found in EdgeMAX EdgeRouter could allow a malicious actor to execute a man-in-the-middle MitM attack during a firmware update. Recommendations: For EdgeMAX...

HPESBHF04134 rev.1 - HPE SimpliVity using HPE Integrated Lights-Out 5 (iLO 5) and HPE Integrated Lights-Out 4 (iLO 4), Multiple Remote and Local Vulnerabilities

Potential Security Impact: Local: Buffer Overflow; Remote: Cross-Site Scripting XSS, Carriage Return Line Feed CRLF Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers -Prior to version 2.44 HPE Integrated Lights-Out 4...

JVN#71263107: Multiple vulnerabilities in Cisco Small Business Series Wireless Access Points

Cisco Small Business Series Wireless Access Points provided by Cisco Systems, Inc. contain multiple vulnerabilities listed below. Improper access control CWE-284 - CVE-2021-1400 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2|...

What does WiFi stand for?

We use WiFi to connect to the Internet, but what is it, and what does it stand for? How does it have such a catchy name, and why do we sometimes have a weak Internet connection with a strong WiFi signal and vice versa? Read on to answer these questions and more. What does WiFi mean? Many people...

RFNTPS vulnerable to OS command injection

Overview RFNTPS provided by NIPPON ANTENNA Co.,Ltd. is a terrestrial reception type NTP server. RFNTPS contains an OS command injection vulnerability CWE-78. Tomoomi Iwata of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#13076220: RFNTPS vulnerable to OS command injection

RFNTPS provided by NIPPON ANTENNA Co.,Ltd. is a terrestrial reception type NTP server. RFNTPS contains an OS command injection vulnerability CWE-78. Impact A user on the same LAN who can access the product may execute an arbitrary OS command with root privilege. Solution Update the Firmware Updat...