Multiple vulnerabilities in I-O DATA wireless LAN routers

Overview Wireless LAN routers provided by I-O DATA DEVICE, INC. contains multiple vulnerabilities listed below. Hidden functionality CWE-912 - CVE-2025-55075 OS command injection CWE-78 - CVE-2025-58116 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinat...

I-O DATA WN-7D36QR 操作系统命令注入漏洞

The I-O DATA WN-7D36QR is a wireless router from I-O DATA Japan. The I-O DATA WN-7D36QR suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which could lead to remote command execution...

I-O DATA WN-7D36QR 安全漏洞

The I-O DATA WN-7D36QR is a wireless router from I-O DATA Japan. A security vulnerability exists in the I-O DATA WN-7D36QR, which stems from the presence of a hidden feature that could lead to a remote authentication attacker enabling SSH...

CVE-2013-4712

I-O DATA DEVICE HDL-A and HDL2-A devices with firmware 1.07 and earlier do not properly manage sessions, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors...

CVE-2025-32002

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32002

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32738

CVE-2025-32738 affects I-O DATA HDL-T Series network-attached HDDs with firmware versions 1.21 and earlier. The flaw is a missing authentication for a critical function, enabling a remote unauthenticated attacker to change product settings. Public sources (JVNDB/Red Hat/US CVE feeds) confirm the ...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

CVE-2025-32002

The CVE-2025-32002 issue affects I-O DATA HDL-T Series network attached storage with firmware 1.21 and earlier, where enabling the Remote Link3 function allows an unauthenticated remote attacker to execute arbitrary OS commands due to improper neutralization of OS command elements. Documented imp...

CVE-2025-32002

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

I-O Data HDL-T 访问控制错误漏洞

I-O Data HDL-T is a series of network hard disks from I-O Data Japan. An access control error vulnerability exists in I-O Data HDL-T version 1.21 and earlier, which stems from a lack of authentication for critical functions and could result in changes to product settings...

PT-2025-21272 · I O Data · I-O Data Hdl-T Series

Name of the Vulnerable Software and Affected Versions: I-O DATA HDL-T Series versions 1.21 and earlier Description: The issue is related to a lack of authentication for critical functions in the firmware. This could allow a remote unauthenticated attacker to modify the product's configuration...

PT-2025-21217 · I O Data · I-O Data Hdl-T Series

Name of the Vulnerable Software and Affected Versions: I-O DATA HDL-T Series firmware versions 1.21 and earlier Description: The issue is related to the improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This problem exists in the I-O DATA...

I-O Data Device UD-LT2 操作系统命令注入漏洞

The I-O Data Device UD-LT2 is a wireless router from I-O Data Device Japan. An operating system command injection vulnerability exists in I-O Data Device UD-LT2 1.00.008SE and prior versions, which stems from the presence of a special element that is not properly neutralized, which could allow an...

I-O Data Device UD-LT2 安全漏洞

I-O Data Device UD-LT2 is a wireless router from I-O Data Device Japan. A security vulnerability exists in I-O Data Device UD-LT2 1.00.008SE and prior versions, which stems from an inclusion of undocumented functionality issue that could allow a remote attacker to disable the LAN-side firewall...

JVN#15293958: Multiple vulnerabilities in I-O DATA router UD-LT2

UD-LT2 provided by I-O DATA DEVICE, INC. contains multiple vulnerabilities listed below. OS Command Injection CWE-78 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2 CVE-2025-20617, CVE-2025-26856 Inclusion of Undocumented Features CWE-1242 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N...

I-O Data Device UD-LT2 操作系统命令注入漏洞

I-O Data Device UD-LT2 is a wireless router from I-O Data Device Japan. An operating system command injection vulnerability exists in I-O Data Device UD-LT2 1.00.008SE and prior versions, which stems from the presence of a disjointed special element that allows an attacker to execute arbitrary...