Introducing security for unmanaged devices in the Enterprise network with Microsoft Defender for IoT

How many IoT devices are used at your company? If yours is like most organizations, there are probably printers, scanners, and fax machines scattered around the office. Perhaps smart TVs are mounted at reception or in the break room to guide visitors and keep employees up-to-date on company event...

MAL-2022-3941 Malicious code in iot-device-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2054ba3bbed2d19afe559eb23210cfaa9a28260235af1d953cbc978f05011643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-device-update-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a41aebeb765add539c5812a2506d600623e9f369a15da042b5c98e31a421c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3942 Malicious code in iot-device-update-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a41aebeb765add539c5812a2506d600623e9f369a15da042b5c98e31a421c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-device-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2054ba3bbed2d19afe559eb23210cfaa9a28260235af1d953cbc978f05011643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-device-samples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b413b38d47a660ca3a66004c282238911b4785237fef25d1eb561381309e840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3940 Malicious code in iot-device-samples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b413b38d47a660ca3a66004c282238911b4785237fef25d1eb561381309e840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unspecified vulnerability in iot-device-sdk-embedded-c

iot-device-sdk-embedded-c is an application plugin. The Google Cloud IoT Device SDK for embedded C is an easily portable open source C library that connects low-end IoT devices to Google Cloud IoT Core. iot-device-sdk-embedded-c suffers from a security vulnerability that stems from the...

Nozomi Networks Guardian Input Validation Error Vulnerability

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the administrator or import...

Nozomi Networks Guardian Input Validation Error Vulnerability (CNVD-2022-29575)

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the role of Administrator or...

Dbltek GoIP - Local File Inclusion Vulnerability

Exploit Title: Dbltek GoIP - Local File Inclusion Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a VoIP-GSM gateway...

Dbltek GoIP GHSFVT-1.1-67-5 Local File Inclusion

Exploit Title: Dbltek GoIP - Local File Inclusion Date: 20.02.2022 Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a...

Dbltek GoIP - Local File Inclusion

Exploit Title: Dbltek GoIP - Local File Inclusion Date: 20.02.2022 Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a...

Improper certificate management in AWS IoT Device SDK v2

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

GHSA-C4RH-4376-GFF4 Improper certificate management in AWS IoT Device SDK v2

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

GHSA-743R-5G92-5VGF Improper certificate management in AWS IoT Device SDK v2

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.4.2, Python versions prior to 1.6.1, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.3 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in the...

Improper certificate management in AWS IoT Device SDK v2

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.4.2, Python versions prior to 1.6.1, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.3 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in the...

Improper certificate management in AWS IoT Device SDK v2

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...

GHSA-94JQ-Q5V2-76WJ Improper certificate management in AWS IoT Device SDK v2

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...

@nordicsemiconductor/asset-tracker-cloud-aws (31.2.0-aws-iot-device-sdk-v2.1) potentially affected by CVE-2021-40831 via aws-iot-device-sdk-v2 (1.5.4)

aws-iot-device-sdk-v2 NPM version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on aws-iot-device-sdk-v2 and may be impacted: - @nordicsemiconductor/asset-tracker-cloud-aws 31.2.0-aws-iot-device-sdk-v2.1 Source cves: CVE-2021-40831 Source advisory...