Weak Password Vulnerability in H3C ER3108GW System Management

ER3108GW is a new generation of enterprise-class wireless high-performance router launched by Hangzhou Huasan Communication Technology Co. A weak password vulnerability exists in the H3C ER3108GW system management, which can be exploited by an attacker to log into the system backend and obtain...

SOYAL Biometric Access Control System 5.0 Master Code Disclosure

Summary Soyal Access systems are built into Raytel Door Entry Systems and are providing access and lift control to many buildings from public and private apartment blocks to prestigious public buildings. Description The controller suffers from a cleartext transmission of sensitive information. Th...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Factory Reset

Summary JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Authentication Bypass

Summary JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth...

SOYAL 701Client 9.0.1 Insecure Permissions

Summary 701 Client is the user interface software for the access control system. It is used for adding and deleting tokens, setting door groups for access, setting time zones for limiting access and monitoring ingress and egress on a live system, among other things. Description The application...

SOYAL Biometric Access Control System 5.0 CSRF Change Admin Password

Summary Soyal Access systems are built into Raytel Door Entry Systems and are providing access and lift control to many buildings from public and private apartment blocks to prestigious public buildings. Description The application interface allows users to perform certain actions via HTTP reques...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Weak Default WiFi Password Algorithm

Summary JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Privilege Escalation

Summary JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration

Summary JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Improper Access Control (IDOR)

Summary JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth...

SQL Injection Vulnerability in LJCMS of Beijing Liangjing Zhicheng Technology Co., Ltd (CNVD-2021-24966)

LJCMS is a free and open source content management system. Beijing Liangjingzhicheng Technology Co., Ltd LJCMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Directory Traversal Vulnerability in iOffice.net Information Management Platform of Guangzhou Redfan Technology Co.

iOffice.net is the information management platform developed by Redfan Technology based on the latest technology of Microsoft . Ltd. iOffice.net information management platform exists directory traversal vulnerability, attackers can use the vulnerability to obtain sensitive information...

State-sponsored Threat Groups Target Telcos, Steal 5G Secrets

Chinese-language APTs are targeting telecom companies in cyberespionage campaigns aimed at stealing sensitive data and trade secrets tied to 5G technology, according to researchers. The campaigns, dubbed “Operation Diànxùn”, target and lure victims working in the telecom industry. A typical ploy...

A New Paradigm in Data Security: Insider Risk Management

The pandemic was a force accelerator for digital transformation in the enterprise. It’s not just the dramatic remote work shift — it’s a profound shift toward prioritizing speed and flexibility as the drivers of a company’s competitive advantage. But as faster, more agile ways of working...

Aggressive 750W Command Execution Vulnerability in Shanghai Atech Technology Co.

The Aggressive 750W is an enterprise-grade wireless router. A command execution vulnerability exists in the Shanghai Atech Aggressive 750W. An attacker can exploit this vulnerability to gain server privileges...

SQL Injection Vulnerability in E-Trend Intelligent eHR Management Platform (CNVD-2021-24430)

Wenzhou E-Ten Information Technology Co., Ltd. is mainly engaged in E-Ten human resource management software, is a high-tech company dedicated to the development of human resource management software products. E-Trend Intelligent eHR Management Platform has SQL injection vulnerabilities, which ca...

Unauthorized Access Vulnerability in Tenda Wireless Routers

Shenzhen Jixiang Tengda Technology Co., Ltd. is a high-tech enterprise integrating independent research and development, production and sales of network equipment. Unauthorized access vulnerability exists in Tenda wireless router. Attackers can use the vulnerability to access the backend and obta...

SQL Injection Vulnerability in LJCMS of Beijing Liangjing Zhicheng Technology Co., Ltd (CNVD-2021-24428)

LJCMS is a free and open source content management system. Beijing Liangjingzhicheng Technology Co., Ltd LJCMS suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

Security Bulletin: IBM SDK, Java Technology Edition, Security Update February 2021

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, 8 that are used by Rational Application Developer®. These issues were disclosed as part of the IBM Java SDK updates in February 2021. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is...

Security Bulletin: Rational Application Developer is vulnerable to CVE-2020-2773

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition 8 used by Rational Application Developer®. These issues were disclosed as part of the IBM Java SDK updates in April 2020. Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related t...