MoqHao Android Malware Evolves with Auto-Execution Capability

Threat hunters have identified a new variant of Android malware called MoqHao that automatically executes on infected devices without requiring any user interaction. "Typical MoqHao requires users to install and launch the app to get their desired purpose, but this new variant requires no...

CVE-2023-47867

MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device...

Design/Logic Flaw

MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device...

CVE-2023-47867 MachineSense FeverWarn Improper Access Control

MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device...

CVE-2023-47867 MachineSense FeverWarn Improper Access Control

MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device...

CVE-2023-47867

CVE-2023-47867 affects MachineSense FeverWarn devices (ESP32, RaspberryPi, DataHub RaspberryPi). The shared details describe an improper access control flaw where FeverWarn devices are configured as Wi‑Fi hosts, enabling attackers within range to connect to the device’s web services and compromis...

Tenda PA6 Buffer Overflow Vulnerability

Tenda PA6 Wi-Fi Powerline extender is a wireless network range extender from Tenda China. A buffer overflow vulnerability exists in Tenda PA6 version 1.0.1.21, which originates from the groupName parameter of the cgiPortMapAdd function in the /portmap file that fails to correctly validate the...

CVE-2023-35836

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the...

CVE-2023-46889

Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network...

CVE-2023-42144

Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password...

Design/Logic Flaw

Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password...

CVE-2023-46889

Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network...

CVE-2023-35836

The CVE-2023-35836 issue affects SolaX Pocket WiFi versions 3 through 3.001.02. A nearby attacker (RF range) can capture a plaintext copy of the device’s network configuration, including the Wi‑Fi PSK, during setup or reconfiguration. This enables further access to the target’s Wi‑Fi networks. Re...

CVE-2023-35836

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the...

CVE-2023-46889

Meross MSH30Q (4.5.23) is vulnerable to Cleartext Transmission of Sensitive Information. During device setup, the device creates an unprotected Wi‑Fi Access Point to connect to the Internet, causing the Wi‑Fi SSID and password to be transmitted between the MSH30Q and the mobile app over the Wi‑Fi...

CVE-2023-42144

Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password...

CVE-2023-35836

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the...

CVE-2023-42144

Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password...

CVE-2023-42144

CVE-2023-42144 affects Shelly TRV 20220811-15234 v2.1.8. Root cause is cleartext transmission during initial setup, enabling a local attacker to obtain the Wi‑Fi password. Public exploit details are not provided. Remediation guidance in the connected docs points to updating Shelly TRV to a versio...

CVE-2023-46889

Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network...