TP-LINK Wi-Fi Repeater to a vulnerability that can be used for remote code execution-vulnerability warning-the black bar safety net

IBM X-Force researcher Grzegorz Wypych recently issued a warning that some of the TP-Link Wi-Fi Repeater devices there is a serious remote code execution vulnerability, the vulnerability can lead to external attackers access device privileges and execute arbitrary commands. ! IBM Security section...

CVE-2017-10724

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows...

CVE-2017-10720

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installe...

CVE-2017-10722

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is...

Stack overflow

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installe...

Stack overflow

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is...

Memory corruption

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows...

CVE-2017-10720

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installe...

CVE-2017-10720

CVE-2017-10720 concerns the Shekar Endoscope desktop software. The issue is a stack overflow in the desktop application when more than 26 characters are provided for the Wi‑Fi name. The vulnerable code path involves the DLL avilib.dll and a function flow culminating in a memmove call that uses a ...

CVE-2017-10722

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is...

CVE-2017-10722

CVE-2017-10722 concerns a stack overflow in the Shekar Endoscope’s desktop controller when a Wi‑Fi password longer than 26 characters is processed. The vulnerable path involves the avilib.dll routine that handles a change-password action via sendchangepass, with the input length contributing to a...

CVE-2017-10724

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows...

CVE-2017-10724

CVE-2017-10724 describes a memory corruption/overflow issue in the firmware of the Shekar Endoscope. The vulnerability arises in the UDP handling path: a crafted UDP request to change the Wi‑Fi name is processed by the control_Dev_thread, leading to a call to setwifipassword which uses memcpy wit...

CVE-2017-10723

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows...

CVE-2017-10719

The CVE-2017-10719 entry concerns the Shekar Endoscope device. The connected documents indicate the vulnerability stems from default Wi‑Fi credentials that are identical across devices, enabling potential unauthorized access to video feeds and stored images and possibly facilitating footholds in ...

CVE-2017-10719

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has default Wi-Fi credentials that are exactly the same for every device. This device acts as an Endoscope camera that allows its users to use it in various...

Code injection

Starry Station aka Starry Router sets the Access-Control-Allow-Origin header to "". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are...

CVE-2017-13718

The HTTP API supported by Starry Station aka Starry Router allows brute forcing the PIN setup by the user on the device, and this allows an attacker to change the Wi-Fi settings and PIN, as well as port forward and expose any internal device's port to the Internet. It was identified that the devi...

CVE-2017-13717

Starry Station aka Starry Router sets the Access-Control-Allow-Origin header to "". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are...

CVE-2017-13717

Starry Station aka Starry Router sets the Access-Control-Allow-Origin header to "". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are...