CVE-2020-16204

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W all versions...

CVE-2020-16259

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user...

CVE-2020-15835

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the...

CVE-2018-6446

A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications...

CVE-2019-5139

An exploitable use of hard-coded credentials vulnerability exists in multiple iw utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts...

CVE-2018-18202

The QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 modules for IBM BladeCenter have an undocumented support account with a support password, an undocumented diags account with a diags password, and an undocumented prom account with a prom password...

Communications Backdoor in Chinese Power Inverters

This is a weird story: U.S. energy officials are reassessing the risk posed by Chinese-made devices that play a critical role in renewable energy infrastructure after unexplained communication equipment was found inside some of them, two people familiar with the matter said. … Over the past nine...

The vulnerability of the Digma A-172 mobile phone lies in the presence of undocumented features, which allow a hacker to send SMS messages without the user’s knowledge.

The vulnerability of the Digma A-172 mobile phone lies in the presence of undocumented features. Exploiting this vulnerability could allow a remote attacker to send SMS messages without the user’s knowledge...

CVE-2025-46617

Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and...

CVE-2025-46617

The CVE-2025-46617 issue affects Quantum StorNext components: StorNext RYO, StorNext Xcellis Workflow Director, and ActiveScale Cold Storage, all prior to version 7.2.4. The vulnerability enables access to internal StorNext configuration and allows unauthorized modification of several software co...

Quantum StorNext Web GUI API 信任管理问题漏洞

The Quantum StorNext Web GUI API is a high-performance file sharing and data management interface from Quantum. A security vulnerability exists in the Quantum StorNext Web GUI API prior to version 7.2.4, which stems from possible access to internal configurations and modification of software...

📄 CommScope Ruckus IoT Controller 1.7.1.0 Backdoor Account

CommScope Ruckus IoT Controller version 1.7.1.0 has an undocumented backdoor account. Exploit Title: CommScope Ruckus IoT Controller 1.7.1.0 - Undocumented Account Date: 2021.05.26 Exploit Author: korelogic Vendor Homepage:...

Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account

Exploit Title: CommScope Ruckus IoT Controller 1.7.1.0 - Undocumented Account Date: 2021.05.26 Exploit Author: korelogic Vendor Homepage: https://www.commscope.com/globalassets/digizuite/917216-faq-security-advisory-id-20210525-v1-0.pdf Affected Product: Ruckus IoT Controller Version: 1.7.1.0 and...

CVE-2025-2894

Concrete details exist for CVE-2025-2894 in connected docs: Unitree Go1 family robots (Go2, G1, H1, B2) expose a BLE Wi‑Fi configuration interface with a hardcoded AES-CFB128 key and IV, enabling an authentication bypass (

Unitree Go 1 安全漏洞

Unitree Go 1 is a robotic dog from the Chinese company Unitree. Unitree Go 1 suffers from a security vulnerability that stems from an undocumented backdoor that could lead to full remote control of the device by the manufacturer or a person in possession of an API key...

The vulnerability of the HCI interface of Espressif ESP32 microcontroller software allows a hacker to circumvent existing security restrictions.

The vulnerability of the HCI interface in Espressif ESP32 microcontroller software lies in the presence of undocumented configuration commands. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

Exploits and vulnerabilities in Q4 2024

Q4 2024 saw fewer published exploits for Windows and Linux compared to the first three quarters. Although the number of registered vulnerabilities continued to rise, the total number of Proof of Concept PoC instances decreased compared to 2023. Among notable techniques in Q4, attackers leveraged...

CVE-2020-13365

Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session as root. This affects NAS520 V5.21AASZ.4C0, V5.21AASZ.0C0, V5.11AASZ.3C0, and V5.11AASZ.0C0; NAS542 V5.11ABAG.0C0,...

CVE-2024-32740

A vulnerability has been identified in SIMATIC CN 4100 All versions V3.0. The affected device contains undocumented users and credentials. An attacker could misuse the credentials to compromise the device locally or over the network...

CVE-2025-22450

Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports...