Var1200-H Firmware Security Vulnerabilities

CVE-2024-29082

Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9and prior, enables an unauthenticated remote attacker to bypassauthentication and factory reset the device via unprotected goformendpoints.

CVE-2024-37023

Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, softwareversions 3.3.23.6.9 and prior, enable an authenticated remote attackerto execute arbitrary OS commands via various endpoint parameters.

CVE-2024-39791

Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions3.3.23.6.9 and prior, enable an unauthenticated remote attacker toexecute arbitrary code.

CVE-2024-39815

Improper check or handling of exceptional conditions vulnerabilityaffecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticatedremote attacker to cause a denial of service. A specially-craftedHTTP request to pre-authentic...

CVE-2024-41161

Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and WiFi bridge repeaters, software versions3.3.23.6.9 and prior, enables an unauthenticated remote attacker tobypass authentication using hard-coded administrator credentials. Theseaccounts cannot be disable...

CVE-2024-41936

A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9and prior, enables an unauthenticated remote attacker to read arbitraryfiles and bypass authentication.

CVE-2024-42001

An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions3.3.23.6.9 and prior enables an unauthenticated remote attacker tobypass authentication via a specially crafted direct request whenanother user has an active session.