CVE-2021-33220: Use of Hard-coded Credentials

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist...

CVE-2021-33218: Use of Hard-coded Credentials

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access...

CVE-2021-33217: Out-of-bounds Write

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root...

Weak Password Vulnerability in Hikvision Backup Management Server

Hikvision is a provider of video-centric intelligent IoT solutions and big data services. A weak password vulnerability exists in Hikvision's backup management server, which can be exploited by attackers to obtain sensitive information...

Directory Traversal Vulnerability in Backup Management Server of Hangzhou Hikvision Digital Technology Co.

Hikvision is a provider of video-centric intelligent IoT solutions and big data services. A directory traversal vulnerability exists in the backup management server of Hangzhou Hikvision Digital Technology Co. Ltd. that can be exploited by attackers to obtain sensitive information...

A week in security (June 28 – July 4)

Last week on Malwarebytes Labs: Is it Game Over for VR Advergaming? Lil’ skimmer, the Magecart impersonator What is the WireGuard VPN protocol? Binance receives the ban hammer from UK’s FCA Fired by algorithm: The future’s here and it’s a robot wearing a white collar Second colossal Linkedin...

ACRN Null Pointer Dereference Vulnerability

ACRN is an open source project released by the Linux Foundation, a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in virtionetpingrxq in devicemodel/hw/pci/virtio/virtionet.c in versions prior to ACRN 2.5. No details of the vulnerability are...

Arbitrary File Download Vulnerability in Networking Gateway of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision Digital Technology Co., Ltd. is a video-centered Internet of Things solution provider, offering integrated security, smart business and big data services. An arbitrary file download vulnerability exists in the networking gateway of Hangzhou Hikvision Digital Technology Co. Ltd,...

ACRN Null Pointer Dereference Vulnerability (CNVD-2021-49151)

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in devicemodel/hw/pci/xhci.c in versions prior to ACRN 2.5. No details of the vulnerability are provided at this time...

ACRN Reuse After Release Vulnerability

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. Device Model in ACRN suffers from a devicemodel/core/mem.c post-release reuse vulnerability. No details of the vulnerability are available at this time...

ACRN post-release reuse vulnerability (CNVD-2021-49149)

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A post-release reuse vulnerability exists in the polling timer handler in ACRN related to devicemodel/hw/pci/virtio/.c. The vulnerability is not known. No detailed...

ACRN Buffer Overflow Vulnerability

ACRN is an open source project released by the Linux Foundation, a hypervisor designed for IoT and embedded devices. An irteallocbitmap buffer overflow vulnerability exists in dmarfreeirte in hypervisor/arch/x86/vtd.c in versions prior to ACRN 2.5. No detailed vulnerability details are provided a...

SQL Injection Vulnerability in Networking Gateway of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision Digital Technology Co., Ltd. is a video-centered Internet of Things solution provider, offering integrated security, smart business and big data services. A SQL injection vulnerability exists in the networking gateway of Hangzhou Hikvision Digital Technology Co. Ltd, which can ...

ACRN code issue vulnerabilities

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in devicemodel/hw/pci/xhci.c in versions prior to ACRN 2.5. No details of the vulnerability are provided at this time...

Microsoft finds new NETGEAR firmware vulnerabilities that could lead to identity theft and full system compromise

The continuous improvement of security solutions has forced attackers to explore alternative ways to compromise systems. The rising number of firmware attacks and ransomware attacks via VPN devices and other internet-facing systems are examples of attacks initiated outside and below the operating...

Microsoft finds new NETGEAR firmware vulnerabilities that could lead to identity theft and full system compromise

The continuous improvement of security solutions has forced attackers to explore alternative ways to compromise systems. The rising number of firmware attacks and ransomware attacks via VPN devices and other internet-facing systems are examples of attacks initiated outside and below the operating...

JetLinks open source IoT platform suffers from weak password vulnerability

JetLinks open source Internet of Things platform based on Java8, Spring Boot 2.x, WebFlux, Netty, Vert.x, Reactor and other development , is an out-of-the-box , secondary development of enterprise-class Internet of Things infrastructure platform . JetLinks open source IoT platform has a weak...

5G Security Vulnerabilities Fluster Mobile Operators

As 5G private networks roll out in the coming years, security may be a key issue for enterprises. A survey released at Mobile World Congress on Monday shows that major gaps persist in security capabilities among mobile operators. Some 68 percent of operators already sell private wireless networks...

Netgear WNAP320 2.0.3 Remote Code Execution

Exploit Title: Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution RCE Unauthenticated Vulnerability: Remote Command Execution on /boardDataWW.php macAddress parameter Notes: The RCE doesn't need to be authenticated Date: 26/06/2021 Exploit Author: Bryan Leong IoT Device: Netgear WNAP320...

Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)

Exploit Title: Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution RCE Unauthenticated Vulnerability: Remote Command Execution on /boardDataWW.php macAddress parameter Notes: The RCE doesn't need to be authenticated Date: 26/06/2021 Exploit Author: Bryan Leong IoT Device: Netgear WNAP320...