Hardcoded credentials

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The device ships with a hardcoded 12345678 password for the root account, accessible from a TELNET login prompt...

Code injection

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. The HTTP web server on the camera allows anyone to view or download the video archive recorded and saved o...

CVE-2019-12920

Summary: CVE-2019-12920 affects Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4. Vulnerability: devices ship with a hardcoded root password (12345678) accessible from a TELNET prompt, enabling a network attacker to login remotely and gain root access. Root cause: hardcoded credential ...

CVE-2019-12920

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The device ships with a hardcoded 12345678 password for the root account, accessible from a TELNET login prompt...

CVE-2019-12919

CVE-2019-12919 affects Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4. The connected Red Hat/CNVD/NVD records describe an unauthenticated attacker on the local network gaining access to the device’s internal SD card through the HTTP service on port 8000, enabling viewing or downloadi...

CVE-2019-12919

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. The HTTP web server on the camera allows anyone to view or download the video archive recorded and saved o...

Samsung asks users to scan their Smart TVs for malware – Here’s how to

By Waqas Samsung tweeted and then deleted that tweet stating that users should scan their Smart TVs for malware “every few weeks.” Smart devices are vulnerable to all sorts of digital threats, and this is not a hidden reality as we often hear about internet connected devices getting hacked or...

CVE-2018-18425

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

Hardcoded credentials

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

CVE-2018-18425

CVE-2018-18425 concerns Primeo (PEO), an Ethereum token. The doAirdrop function does not enforce a correct relation between the airdropped amount and the token’s total supply, allowing the contract owner to issue arbitrary currency. This bypasses the hard cap written in the contract and can deval...

CVE-2018-18425

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

Supra Smart Cloud TV Remote File Inclusion

An authentication bypass vulnerability exists in Supra Smart Cloud TV. Successful exploitation of this vulnerability would allow a local attacker to broadcast any video without any authentication or to broadcast a fake emergency message...

Smart cities, difficult choices: privacy and security on the grid

All is not well in the land of smart city planning, as the latest major planned development from Google's sister company Sidewalk Labs continues to run into problems in Toronto, Canada. A groundswell of support? Building a city “From the ground up” is apparently no longer a thing: at least some...

CleverDog Smart Camera DOG-2W / DOG-2W-V4 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications 1. Advisory Information ======================================== Title: Clever Dog Smart Camera Vendor Homepage: http://www.cleverdog.com.cn/ Tested on Camera types : DOG-2W, DOG-2W-V4 Vulnerability: Hardware- Multiple Vulnerabilities Dat...

Check Point Response to CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 - TCP SACK PANIC Linux Kernel vulnerabilities

Cause CVE-2019-11477: The Linux kernel is vulnerable to an integer overflow in the 16-bit width of TCPSKBCBskb- tcpgsosegs. A remote attacker could exploit this to crash the system and create a Denial Of Service. CVE-2019-11478: The Linux kernel is vulnerable to a flaw that allows attackers to se...

HPE Smart Update Manager Security Feature Issue Vulnerability

HPE Smart Update Manager SUM is a smart update manager from Hewlett Packard Enterprise HPE, USA. It is used to install and update firmware and software components on HP ProLiant and HP Integrity servers, chassis, and options. A security feature issue vulnerability exists in versions of HPE SUM...

Tzumi Electronics Klic Lock Authentication Bypass

CVE-2019-11334 MIT License Copyright c 2019 Kerry Enfinger Python program to unlock any Tzumi Klic smart locks Model 5686 Firmware 6.2 May work on other smart locks Requires valid account email and password from Klic mobile application import argparse import requests import json from subprocess...

Android's Built-in Security Key Now Works With iOS Devices For Secure Login

In April this year, a software update from Google overnight turned all Android phones, running Android 7.0 Nougat and up, into a FIDO-certified hardware security key as part of a push to encourage two-step verification. The feature made it possible for users to confirm their identity when logging...

Android's Built-in Security Key Now Works With iOS Devices For Secure Login

In April this year, a software update from Google overnight turned all Android phones, running Android 7.0 Nougat and up, into a FIDO-certified hardware security key as part of a push to encourage two-step verification. The feature made it possible for users to confirm their identity when logging...

Authentication flaw

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...