CVE-2021-33217

CVE-2021-33217 affects CommScope Ruckus IoT Controller (1.7.1.0 and earlier). The web application uses a node-red NodeJS module with root privileges, allowing authenticated users to read/write arbitrary files on the device filesystem via the web UI and API (e.g., POST to /node-red/flows to access...

CVE-2021-33216

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account...

CVE-2021-33216

CVE-2021-33216 affects CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An undocumented backdoor exists via an upgrade account (vriotiotupgrade) with SSH/SCP access, enabled by an authorized_keys entry and restricted rssh configuration, enabling shell access when the OVA is mounted. Documente...

CVE-2021-33215

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal...

CVE-2021-33215

CVE-2021-33215 affects CommScope Ruckus IoT Controller (versions 1.7.1.0 and earlier). The vulnerability is a directory traversal in the web interface (via the Python web.py in the Dockerized webservice), allowing an authenticated attacker to view files outside the restricted directory. The vulne...

Weak Password Vulnerability in Hikvision Backup Management Server

Hikvision is a provider of video-centric intelligent IoT solutions and big data services. A weak password vulnerability exists in Hikvision's backup management server, which can be exploited by attackers to obtain sensitive information...

Directory Traversal Vulnerability in Backup Management Server of Hangzhou Hikvision Digital Technology Co.

Hikvision is a provider of video-centric intelligent IoT solutions and big data services. A directory traversal vulnerability exists in the backup management server of Hangzhou Hikvision Digital Technology Co. Ltd. that can be exploited by attackers to obtain sensitive information...

A week in security (June 28 – July 4)

Last week on Malwarebytes Labs: Is it Game Over for VR Advergaming? Lil’ skimmer, the Magecart impersonator What is the WireGuard VPN protocol? Binance receives the ban hammer from UK’s FCA Fired by algorithm: The future’s here and it’s a robot wearing a white collar Second colossal Linkedin...

ACRN post-release reuse vulnerability (CNVD-2021-49149)

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A post-release reuse vulnerability exists in the polling timer handler in ACRN related to devicemodel/hw/pci/virtio/.c. The vulnerability is not known. No detailed...

ACRN Buffer Overflow Vulnerability

ACRN is an open source project released by the Linux Foundation, a hypervisor designed for IoT and embedded devices. An irteallocbitmap buffer overflow vulnerability exists in dmarfreeirte in hypervisor/arch/x86/vtd.c in versions prior to ACRN 2.5. No detailed vulnerability details are provided a...

Arbitrary File Download Vulnerability in Networking Gateway of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision Digital Technology Co., Ltd. is a video-centered Internet of Things solution provider, offering integrated security, smart business and big data services. An arbitrary file download vulnerability exists in the networking gateway of Hangzhou Hikvision Digital Technology Co. Ltd,...

ACRN Reuse After Release Vulnerability

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. Device Model in ACRN suffers from a devicemodel/core/mem.c post-release reuse vulnerability. No details of the vulnerability are available at this time...

ACRN Null Pointer Dereference Vulnerability (CNVD-2021-49151)

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in devicemodel/hw/pci/xhci.c in versions prior to ACRN 2.5. No details of the vulnerability are provided at this time...

ACRN Null Pointer Dereference Vulnerability

ACRN is an open source project released by the Linux Foundation, a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in virtionetpingrxq in devicemodel/hw/pci/virtio/virtionet.c in versions prior to ACRN 2.5. No details of the vulnerability are...

SQL Injection Vulnerability in Networking Gateway of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision Digital Technology Co., Ltd. is a video-centered Internet of Things solution provider, offering integrated security, smart business and big data services. A SQL injection vulnerability exists in the networking gateway of Hangzhou Hikvision Digital Technology Co. Ltd, which can ...

ACRN 代码问题漏洞

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in devicemodel/hw/pci/xhci.c in versions prior to ACRN 2.5. No details of the vulnerability are provided at this time...

Microsoft finds new NETGEAR firmware vulnerabilities that could lead to identity theft and full system compromise

The continuous improvement of security solutions has forced attackers to explore alternative ways to compromise systems. The rising number of firmware attacks and ransomware attacks via VPN devices and other internet-facing systems are examples of attacks initiated outside and below the operating...

Microsoft finds new NETGEAR firmware vulnerabilities that could lead to identity theft and full system compromise

The continuous improvement of security solutions has forced attackers to explore alternative ways to compromise systems. The rising number of firmware attacks and ransomware attacks via VPN devices and other internet-facing systems are examples of attacks initiated outside and below the operating...

JetLinks open source IoT platform suffers from weak password vulnerability

JetLinks open source Internet of Things platform based on Java8, Spring Boot 2.x, WebFlux, Netty, Vert.x, Reactor and other development , is an out-of-the-box , secondary development of enterprise-class Internet of Things infrastructure platform . JetLinks open source IoT platform has a weak...

5G Security Vulnerabilities Fluster Mobile Operators

As 5G private networks roll out in the coming years, security may be a key issue for enterprises. A survey released at Mobile World Congress on Monday shows that major gaps persist in security capabilities among mobile operators. Some 68 percent of operators already sell private wireless networks...