OSV-2021-411 UNKNOWN READ in ot::Cli::Interpreter::OutputFormatV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31002 Crash type: UNKNOWN READ Crash state: ot::Cli::Interpreter::OutputFormatV ot::Cli::Interpreter::OutputLine ot::Cli::SrpServer::ProcessDomain...

Advantech WebAccess/SCADA installation local file inclusion

Summary A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability. Tested Versions Advantech...

OSV-2021-396 Heap-buffer-overflow in OT::OffsetTo<OT::Anchor, OT::IntType<unsigned short, 2u>, true>* hb_serialize_co

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30908 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::OffsetTo, true hbserializeco OT::OffsetTo, true hbserializeco bool OT::AnchorMatrix::serializehbfilteriterthbrangeitertunsigned int,...

OSV-2021-386 Stack-buffer-overflow in ot::Coap::Message::AppendUintOption

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30831 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::Coap::Message::AppendUintOption ot::Coap::Message::AppendBlockOption otCoapMessageAppendBlock2Option...

Announcing the general availability of Azure Defender for IoT

As businesses increasingly rely on connected devices to optimize their operations, the number of IoT and Operational Technology OT endpoints is growing dramatically—industry analysts have estimated that CISOs will soon be responsible for an attack surface multiple times larger than just a few yea...

OSV-2017-119 Stack-buffer-overflow in ot::MeshCoP::CommissionerSessionIdTlv::GetCommissionerSessionId

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3376 Crash type: Stack-buffer-overflow READ 2 Crash state: ot::MeshCoP::CommissionerSessionIdTlv::GetCommissionerSessionId ot::NetworkData::Leader::HandleCommissioningSet ot::Coap::Coap::ProcessReceivedRequest...

OSV-2021-152 Stack-buffer-overflow in ot::NetworkData::ServerTlv::GetServer16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5878 Crash type: Stack-buffer-overflow READ 2 Crash state: ot::NetworkData::ServerTlv::GetServer16 ot::NetworkData::Leader::RlocLookup ot::NetworkData::Leader::RegisterNetworkData...

OSV-2018-199 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10986 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-190 Heap-buffer-overflow in OT::Coverage::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10084 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::Coverage::intersects OT::ContextFormat2::closure hbvoidt const OT::hbclosurecontextt::dispatch...

OSV-2018-185 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11001 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::IndexSubtable::getextents OT::IndexSubtableRecord::getextents...

OSV-2018-179 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11290 Crash type: Heap-buffer-overflow READ 5 Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...

OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...

OSV-2018-116 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11060 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-82 Heap-buffer-overflow in OT::LigatureSubstFormat1::closure

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10081 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::LigatureSubstFormat1::closure hbvoidt const OT::hbclosurecontextt::dispatch OT::hbclosurecontextt::returnt OT::LigatureSubst::dispatchOT::hbclosureco...

OSV-2018-56 UNKNOWN READ in OT::propagate_attachment_offsets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11013 Crash type: UNKNOWN READ Crash state: OT::propagateattachmentoffsets OT::propagateattachmentoffsets OT::GPOS::positionfinishoffsets...

OSV-2018-43 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11263 Crash type: Heap-buffer-overflow READ Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...

OSV-2018-26 UNKNOWN READ in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11351 Crash type: UNKNOWN READ Crash state: BEInt::operator unsigned char OT::DeviceRecord::serialize OT::hdmx::serialize...

Win-911 mobile server platform privilege escalation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen, an attacker can overwrite the service executable and execute arbitrary code with System privileges or replace other...

Win-911 Enterprise Platform privilege escalation vulnerability

Summary Multiple exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the privileges when...

Remote Code Execution Vulnerabilities in Secomea, Moxa, and HMS eWon VPNs

Security researchers at Claroty published details on multiple pre-auth remote code execution vulnerabilities affecting virtual private network VPN implementations primarily used to provide remote access to operational technology OT networks. The vulnerabilities could allow unauthenticated attacke...