CVE-2022-34869

The CVE-2022-34869 issue affects CentreCOM AR260S V2 firmware before 3.3.7. A vulnerability exists in an undocumented hidden command accessible via the telnet function, which an authenticated remote attacker can use to execute arbitrary OS commands. The vulnerability is confirmed across multiple ...

The vulnerability of the telnet server’s microprogramming software for the CentreCOM AR260S V2 allows a hacker to increase their privileges.

The vulnerability of the telnet server software for CentreCOM AR260S V2 lies in the presence of undocumented commands. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Allied Telesis CentreCOM AR260S 安全漏洞

The Allied Telesis CentreCOM AR260S is a basic VPN access router from Allied Telesis Japan. A security vulnerability exists in the Allied Telesis CentreCOM AR260S V2 firmware prior to version 3.3.7, which originates from undocumented hidden commands that can be executed by an attacker from the...

JVN#45473612: Multiple vulnerabilities in CentreCOM AR260S V2

CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities listed below. OS command injection vulnerability in GUI setting page CWE-78 - CVE-2022-35273 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2|...

The vulnerability of microprogramming software in industrial software-hardware equipment from General Electric’s Renewable Energy iNET and iNET II lies in the presence of undocumented configuration commands. This allows a hacker to gain full access to the application and compromise the target system.

The vulnerability of microprogrammed software in industrial software-hardware equipment from General Electric’s Renewable Energy iNET and iNET II is related to the presence of undocumented configuration commands. Exploiting this vulnerability can allow a malicious actor, operating remotely, to ga...

CVE-2022-29953

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality...

Hardcoded credentials

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality...

CVE-2022-30270

The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to this interface is controlled by 5...

The vulnerability of the software terminal emulator for the ImageCast X device, which allows a violator to increase their privileges

The vulnerability of the software terminal emulator for the ImageCast X labeling device is related to the presence of undocumented commands. Exploiting this vulnerability can allow an attacker to gain increased privileges...

JUNG Smart Visu Server 安全漏洞

JUNG Smart Visu Server is a Smart Visu Server from JUNG. A security vulnerability exists in JUNG Smart Visu Server versions 1.0.804, 1.0.830, and 1.0.832, which stems from the presence of two undocumented operating system user accounts on the device that can be used to access the Smart Visu Serve...

PT-2022-3085 · Motorola · Motorola Ace1000 Rtu

Name of the Vulnerable Software and Affected Versions: Motorola ACE1000 RTU through 2022-05-02 Description: The issue concerns the use of default credentials for five preconfigured SSH accounts, including root, abuilder, acelogin, cappl, and ace. These accounts are used to control access to the S...

JUNG Smart Visu Server 安全漏洞

JUNG Smart Visu Server is a Smart Visu Server from JUNG. A security vulnerability exists in JUNG Smart Visu Server versions 1.0.804, 1.0.830, and 1.0.832, which stems from the presence of two undocumented operating system user accounts on the device that can be used to access the Smart Visu Serve...

The vulnerability of the microprogramming software used in Mitel 6800 Series SIP Phones and 6900 Series SIP Phones lies in the presence of undocumented configuration commands. This allows a malicious actor to execute arbitrary code with root privileges, as well as gain unauthorized access to protected information.

The vulnerability of the microprogramming software used in Mitel 6800 Series SIP Phones and 6900 Series SIP Phones is related to the presence of undocumented configuration commands. Exploiting this vulnerability allows an attacker to execute arbitrary code with root privileges, as well as gain...

Mitel 6800/6900 Series SIP Phones Backdoor Access Vulnerability

Mitel 6800/6900 Series SIP Phones excluding 6970 and Mitel 6900 Series IP MiNet Phones have a flow to spawn a telnet backdoor on the device with a static root password enabled. Affected versions include Rel 5.1 SP8 5.1.0.8016 and earlier, Rel 6.0 6.0.0.368 to 6.1 HF4 6.1.0.165, and MiNet 1.8.0.12...

Mitel 6800/6900 Series SIP Phones Backdoor Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2022-021 Product: Mitel 6800/6900 Series SIP Phones excluding 6970 Mitel 6900 Series IP MiNet Phones Manufacturer: Mitel Networks Corporation Affected Versions: Rel 5.1 SP8 5.1.0.8016 and earlier Rel 6.0 6.0.0.368 to 6.1 HF4...

CVE-2022-28387

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affec...

CVE-2022-28387

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affec...

PT-2022-3267

Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The issue is related to the Terminal Emulator application in the Dominion Voting Systems ImageCast X, which could be exploited by an attacker to gain elevated...

GHSA-VQ7J-6PCQ-F48P Path traversal vulnerability in Blue Ocean Plugin

Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag, blueocean.features.GITREADSAVETYPE, that when set to the value clone allows an attacker with Item/Configure or Item/Create permission to read arbitrary files on the Jenkins controller file system. Blue Ocean Plugin 1.23.3...

CVE-2022-29855

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 5.1.0.8016 and earlier, and 6.0 6.0.0.368 through 6.1 HF4 6.1.0.165, could allow a unauthenticated...