40 matches found
CVE-2023-43261
CVE-2023-43261 - PoC Milesight 라우터에서 민감한 정보를 노출하고 무단 액세스를 가능하게 하는 치명적인 취약점 날짜: 2023년 10월 1일 제품 공급업체: Milesight 이전 Xiamen Ursalink Technology Co., Ltd. 영향을 받는 제품: UR5X, UR32L, UR32, UR35, UR41 및 취약할 수 있는 다른 산업용 셀룰러 라우터가 있을 수 있습니다. 영향을 받는 펌웨어: 펌웨어 v35.3.0.7에 대한 패치를 확인했습니다. 이전 버전은 취약할 수 있지만 공급업체의 확인...
Milesight Routers - Information Disclosure
A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router...
CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit
CVE-2025-14611 CentreStack 및 Triofox 전체 Poc/Exploit 요약 이 취약점은 Gladinet CentreStack 및 Triofox 제품의 하드코딩된 암호화 키로 인해 발생하며, 위조된 액세스 티켓을 통한 임의 파일 읽기가 가능합니다. AES-256 암호화 구현은 애플리케이션 바이너리GladCtrl64.dll에 직접 내장된 정적이고 변경되지 않는 키를 사용합니다. 이 키를 추출한 공격자는 다음을 수행할 수 있습니다. 1. 합법적인 액세스 티켓을 복호화하여 내부 파일 경로 및 시스템 구성을...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
CVE-2026-57262
The CVE-2026-57262 vulnerability affects LOGO! Soft Comfort (All versions
EUVD-2026-56117
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
PT-2026-70187
Name of the Vulnerable Software and Affected Versions LOGO! Soft Comfort versions prior to V9 Description Products use a static, hardcoded AES master key to encrypt project files. A local attacker could extract this master key from the application files or memory to decrypt project files or remov...
CVE-2026-35019
NetComm NF20MESH routers with firmware R6B031 and earlier are affected by an authentication bypass in the web management interface. The root cause is a hardcoded AES-256 key used to encrypt session cookies; an attacker can forge a valid encrypted cookie with the shared key to bypass authenticatio...
EUVD-2026-38453
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can for...
CVE-2026-6411: Use of a Broken or Risky Cryptographic Algorithm
This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain encrypted tenant email addresses and related metadata from any tenant. Due to the presence of a hardcoded AES key within the application, the encrypted data can be decrypted,...
MAXHUB Pivot client application 加密问题漏洞
The MAXHUB Pivot client application is a client component of the MAXHUB company’s device management platform. Versions of the MAXHUB Pivot client application prior to 1.36.2 contained an encryption vulnerability. This vulnerability stemmed from the hardcoded AES key within the application. It cou...
CVE-2026-42518
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic...
Gladinet CentreStack / Triofox < 16.12.10420.56791 Hardcoded Credentials
According to its banner, the version of Gladinet CentreStack / Triofox running on the remote host is prior to 16.12.10420.56791. It is, therefore, affected by an arbitrary local file inclusion due to the CentreStack / Triofox portal's use hardcoded values for their implementation of the AES...
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially...
CVE-2025-14611
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted...
CVE-2025-52268: Exposure of Sensitive Information to an Unauthorized Actor
StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens...