CVE-2024-47126: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an...

PT-2024-32416 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App versions affected versions not specified goTenna Pro X goTenna Pro X2 Description: The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is capture...

goTenna Pro 安全漏洞

goTenna Pro is a series of devices from goTenna that create networks for off-grid communications and situational awareness. A security vulnerability exists in the goTenna Pro that stems from the use of a weak cipher for QR broadcast messages. If a QR broadcast message is captured via RF, it can b...

CVE-2024-47121: Weak Password Requirements

The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via...

CVE-2024-47128: Insertion of Sensitive Information Into Sent Data

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

rf IDEAS MiCard PLUS Ci和MiCard PLUS BLE 安全漏洞

The rf IDEAS MiCard PLUS Ci and rf IDEAS MiCard PLUS BLE are both a card reader from rf IDEAS, Inc. in the USA. A security vulnerability exists in the rf IDEAS MiCard PLUS Ci and MiCard PLUS BLE that stems from a firmware failure that results in the assignment of an incorrect ID card number durin...

CVE-2024-1578: Improper Validation of Specified Type of Input

The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration...

CVE-2024-37994

Siemens SIMATIC RFID Readers are affected by CVE-2024-37994. A hidden configuration item enables debug functionality, allowing an attacker to gain insight into internal deployment configuration. Affected devices include multiple RF610R/RF615R/RF650R/RF680R/RF685R families (CMIIT/ETSI/FCC/ARIB var...

CVE-2024-37993

The CVE-2024-37993 issue affects Siemens SIMATIC RFID Readers and related RF610R/615R/650R/680R/685R families (and associated components) across multiple harvestable variants. The root cause is improper access control: the affected applications do not authenticate the creation of Ajax2App instanc...

CVE-2024-37992

CVE-2024-37992 affects Siemens SIMATIC RFID Reader family (RF610R/RF615R/RF650R/RF680R/RF685R, RF1140R, RF1170R, RF166C, RF185C, RF186C/CI, RF188C/CI, RF360R). Root cause: improper handling of errors when exceeding characters during SNMP configuration, leading to application restart. Impact state...

CVE-2024-37990

Summary of CVE-2024-37990 (Siemens SIMATIC RFID Readers): A set of undocumented configuration commands in multiple SIMATIC RFID readers (RF610R/615R/650R/680R/685R, RF1140R/1170R, RF166C/185C/186C/188C/360R, etc.) can be modified by someone with privileged access to enable features not released f...

CVE-2024-37990: Hidden Functionality

A vulnerability has been identified in SIMATIC Reader RF610R CMIIT 6GT2811-6BC10-2AA0 All versions V4.2, SIMATIC Reader RF610R ETSI 6GT2811-6BC10-0AA0 All versions V4.2, SIMATIC Reader RF610R FCC 6GT2811-6BC10-1AA0 All versions V4.2, SIMATIC Reader RF615R CMIIT 6GT2811-6CC10-2AA0 All versions V4....

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Device Config Disclosure

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed by a...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Authentication Bypass

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Insecure Direct Object Reference Vulnerability

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link suffers from an unauthenticated device configuration and client-side hidden functionality disclosure vulnerability. Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed...

rf-microwave.com Cross Site Scripting vulnerability OBB-3862053

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-22773: Insecure Storage of Sensitive Information

Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass...

CVE-2024-22773

CVE-2024-22773 affects Intelbras Action RF 1200 routers (version 1.2.2 and earlier) and Action RG 1200 routers (version 2.1.7 and earlier). The root cause described across connected sources is that the devices expose the password in a cookie, enabling a login bypass. This leads to unauthorized ac...

PT-2024-19558 · Intelbras · Intelbras Action Rf 1200

Name of the Vulnerable Software and Affected Versions: Intelbras Action RF 1200 routers versions 1.2.2 and earlier Intelbras Action RG 1200 routers versions 2.1.7 and earlier Description: The issue exposes the password in cookie, resulting in login bypass. This allows unauthorized access to the...