PT-2025-23825 · Cisco · Cisco Unified Ccx

Name of the Vulnerable Software and Affected Versions: Cisco Unified CCX affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, local attacker to execute arbitrary code on an affected device. The issue is due to improper...

SUSE: Security Advisory (SUSE-SU-2025:0327-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NetScaler-13.1-Error "Not logged in" is displayed in console or SSH session to NetScaler

You may see error "Not logged in" displayed in the console session to NetScaler and you are not able to run any commands in this console session. Similar issue may also happen with SSH session to NetScaler...

CVE-2025-41438

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely...

[SECURITY] Fedora 41 Update: dropbear-2025.88-1.fc41

Dropbear is a relatively small SSH server and client. It's particularly useful for "embedded"-type Linux or other Unix systems, such as wireless routers...

CVE-2025-41438

CVE-2025-41438 affects the Consilium Safety CS5000 Fire Panel. The vulnerability stems from a default account with high-level permissions that remains unchanged across installations, and a hard-coded VNC password embedded in the binary, enabling remote access if network access exists. Affected sy...

Fire detection system been pwned? You’re not going to sea

TL;DR Hardcoded SSH and VNC credentials found on Consilium Salwico CS5000 panels SSH access allows OS-level interaction, and VNC access gives UI control It may be possible to disable the fire detection system Attempts to disclose vulnerability to Consilium multiple times since 2022 Consilium...

PT-2025-23215 · Unknown · Cs5000 Fire Panel

Name of the Vulnerable Software and Affected Versions: CS5000 Fire Panel affected versions not specified Description: The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. This account is not root but holds high-level permissions that could severely impact the...

New PumaBot Botnet Targets Linux IoT Devices to Steal SSH Credentials and Mine Crypto

Embedded Linux-based Internet of Things IoT devices have become the target of a new botnet dubbed PumaBot. Written in Go, the botnet is designed to conduct brute-force attacks against SSH instances to expand in size and scale and deliver additional malware to the infected hosts. "Rather than...

ABB M2M Gateway Man-in-the-Middle in embedded OpenSSH (CVE-2023-48795)

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

ABB M2M Gateway Arbitrary Code Execution in embedded OpenSSH (CVE-2023-38408)

The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. Code in /usr/lib is not necessarily safe for loading into ssh-agent. NOTE: this issue exists because o...

Laravel Framework Detection (Linux/Unix SSH Login)

SSH login-based detection of Laravel Framework. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-48415

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor or perform other...

CVE-2025-48413

The /etc/passwd and /etc/shadow files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device...

CVE-2025-41380

Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string...

CVE-2025-41380 Injection vulnerability in Iridium Certus 700

Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string...

CVE-2025-41380

CVE-2025-41380 affects Iridium Certus 700, version 1.0.1. The vulnerability is an embedded credentials issue that lets a local user retrieve the SSH hash string. CVSS v4.0 base score 6.1 (MEDIUM); vector: LOCAL, low attack complexity, no user interaction required, privileges required LOW. Impact ...

CVE-2025-41380 Injection vulnerability in Iridium Certus 700

Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string...

CVE-2025-22968

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions...

CVE-2024-39345

AdTran 834-5 HDC17600021F1 SmartOS 11.1.1.1 devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose password is based on the devices MAC address. All of the devices internet interfaces share a similar MAC address that only varies in their final...