CVE-2023-24825 RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixe...

Retired Software Exploited To Target Power Grids, Microsoft

By Habiba Rashid Boa was discontinued in 2005 but remained popular and is now becoming a crisis because of the complex nature of how it was built into the IoT device supply chain. This is a post from HackRead.com Read the original post: Retired Software Exploited To Target Power Grids, Microsoft...

CVE-2022-41627

The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram EKG has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting soun...

Design/Logic Flaw

The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram EKG has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting soun...

CVE-2022-41627

The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram EKG has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting soun...

CVE-2022-42054

Multiple stored cross-site scripting XSS vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Company Name and Description text fields...

CVE-2022-42055

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

Command injection

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

CVE-2022-42054

Multiple stored cross-site scripting XSS vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Company Name and Description text fields...

PT-2022-26224 · Gl.Inet · Gl.Inet Goodcloud Iot Device Management System

Name of the Vulnerable Software and Affected Versions: GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00 Description: The issue concerns multiple stored cross-site scripting XSS vulnerabilities. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via...

CVE-2022-42055

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

CVE-2020-11015 Device Authentication Vulnerability in thinx-device-api IoT Device Management Server

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be...

CVE-2020-11015 Device Authentication Vulnerability in thinx-device-api IoT Device Management Server

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be...

PT-2022-23621 · Pal Electronics Systems · Palgate

Name of the Vulnerable Software and Affected Versions: Pal Electronics Systems affected versions not specified Description: The issue is an authorization problem in the PalGate device management Android client app, affecting gates of buildings and parking lots controlled by a simple button in any...

Introducing security for unmanaged devices in the Enterprise network with Microsoft Defender for IoT

How many IoT devices are used at your company? If yours is like most organizations, there are probably printers, scanners, and fax machines scattered around the office. Perhaps smart TVs are mounted at reception or in the break room to guide visitors and keep employees up-to-date on company event...

MAL-2022-3941 Malicious code in iot-device-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2054ba3bbed2d19afe559eb23210cfaa9a28260235af1d953cbc978f05011643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-device-update-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a41aebeb765add539c5812a2506d600623e9f369a15da042b5c98e31a421c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3942 Malicious code in iot-device-update-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a41aebeb765add539c5812a2506d600623e9f369a15da042b5c98e31a421c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-device-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2054ba3bbed2d19afe559eb23210cfaa9a28260235af1d953cbc978f05011643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-device-samples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b413b38d47a660ca3a66004c282238911b4785237fef25d1eb561381309e840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...