Auth Bypass Bug Exploited, Millions of Routers Affected

An authentication-bypass vulnerability affecting multiple routers and internet-of-things IoT devices is being actively exploited in the wild, according to researchers. The security flaw, tracked as CVE-2021-20090, was disclosed last week by researchers at Tenable. It affects devices from 20...

A Critical Random Number Generator Flaw Affects Billions of IoT Devices

A critical vulnerability has been disclosed in hardware random number generators used in billions of Internet of Things IoT devices whereby it fails to properly generate random numbers, thus undermining their security and putting them at risk of attacks. "It turns out that these 'randomly' chosen...

Black Hat 2021: Rapid7 Experts Share Key Day 1 Takeaways

OK, no big deal, we know how this goes. Once again, many of us are attending Black Hat in a virtual capacity as COVID-19 meanders its way out of our lives. The good news is that there’s an actual live component again this year in Las Vegas, and that’s progress. Here’s hoping that next year the...

Black Hat: Bugs Allow Takeover of Capsule Hotel Rooms

LAS VEGAS – A series of vulnerabilities in internet of things IoT devices often found in connected hotel rooms allowed a researcher to take control of multiple rooms’ amenities – and punish a loud neighbor. An inadvertent bug hunt began when Kya Supa, security consultant at LEXFO, was traveling...

Cisco IoT Field Network Director DoS (cisco-sa-iot-coap-dos-WTBu6YTq)

A denial of service DoS vulnerability exists in Cisco IoT Field Network Director due to incorrect handling of certain valid, but not typical, Ethernet frames. An unauthenticated, remote attacker can exploit this issue by sending the Ethernet frames onto the Ethernet segment, to cause the device t...

Newark Releases Latest Global IoT Trends Report

The latest trend report also said that security concerns negatively impact the adoption of IoT technologies and the growth of Industry 4.0...

IoT Piranhas Are Swarming Industrial Controls

Full transparency: Curtis Simpson, CISO at Armis, the enterprise IoT security company, was fundamentally a black hat at the age of 12, before he even knew what a black hat was. One day he got flooded over IRC and was fascinated: What just happened? And how did it happen? He’s since spent the vast...

KevinLAB BEMS 1.0 - Undocumented Backdoor Account

Exploit Title: KevinLAB BEMS 1.0 - Undocumented Backdoor Account Date: 05.07.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kevinlab.com Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary:...

KevinLAB BEMS 1.0 Authenticated File Path Traversal / Information Disclosure Vulnerabilities

KevinLAB BEMS version 1.0 suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the page GET parameter in index.php is not properly verified before being used to include files. This can be exploited to disclose the contents of arbitrary and sensitive files vi...

KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass Vulnerabilities

KevinLAB BEMS version 1.0 suffers from an unauthenticated SQL Injection vulnerability. Input passed through inputid POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting...

KevinLAB BEMS 1.0 - Authentication Bypass

Exploit Title: KevinLAB BEMS 1.0 - Unauthenticated SQL Injection / Authentication Bypass Date: 05.07.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kevinlab.com Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Manageme...

KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)

Exploit Title: KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure Authenticated Date: 05.07.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kevinlab.com Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy...

KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass

Summary KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS Building Energy Management System enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of...

KevinLAB BEMS 1.0 Authenticated File Path Traversal / Information Disclosure

KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy...

KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass

KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy...

KevinLAB BEMS 1.0 Undocumented Backdoor Account

KevinLAB BEMS 1.0 Undocumented Backdoor Account Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB'...

The vulnerability of the RPL routing protocol implementation in Contiki-NG operating systems for IoT devices allows a attacker to cause service failures.

The vulnerability of the RPL routing protocol implementation in Contiki-NG IoT devices is related to the lack of a mechanism for checking the size of copied data. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

KevinLAB BEMS 1.0 Undocumented Backdoor Account

Summary KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS Building Energy Management System enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of...

PT-2021-7406 · Qualcomm · Qualcomm Snapdragon Mobile +5

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Auto versions affected versions not specified Qualcomm Snapdragon Compute versions affected versions not specified Qualcomm Snapdragon Connectivity versions affected versions not specified Qualcomm Snapdragon Industrial IO...

Arbitrary file read vulnerability exists in Node-RED (CNVD-2021-54086)

Node-RED is a tool for building Internet of Things IOT applications that focuses on simplifying the "connectivity" of code blocks to perform tasks. Node-RED suffers from an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...