Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,443 results · page 16 of 29

Apr 19, 2021In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints CVE-2021-20990 · Other software · Fibar Group S.A · reported by info@cert.vde.comHigh 7.5
In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.
Product
Fibaro Home Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 19, 2021Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote supCVE-2021-20989 · Other software · Fibar Group S.A · reported by info@cert.vde.comMedium 5.9
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.
Product
Fibaro Home Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21393 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21392 · Other software · matrix-org · reported by GitHubMedium 6.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 12, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21394 · Other software · matrix-org · reported by GitHubMedium 5.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21333 · Other software · matrix-org · reported by GitHubMedium 6.1
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21332 · Other software · matrix-org · reported by GitHubMedium 6.9
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 22, 2021A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" paramCVE-2021-27308 · Other software · 4homepages · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
Product
4images
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 9, 2021An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0.CVE-2020-28952 · Other software · Homey · reported by MITREHigh 7.5
An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices.
Product
Homey Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.athom.com homey.app
Mar 3, 2021An issue was discovered in AdGuard before 0.105.2.CVE-2021-27935 · Other software · Adguard · reported by MITREHigh 7.5
An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of the password is stored in the cookie.
Product
Adguard Home
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21274 · Other software · matrix-org · reported by GitHubMedium 4.3
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 26, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-21273 · Other software · matrix-org · reported by GitHubLow 3.1
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27179 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a string.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27178 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27177 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3QKd2hvCg== string to the telnet server.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27176 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27175 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27174 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27173 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, provided by the HTTP server. This will remove firewall rules and allow an attacker to reach the telnet server (used for the CLI).
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27172 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27171 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on port 26/tcp by using the CLI interface commands of ddd and shell (or tshell).
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27170 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631.CVE-2021-27169 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account.
Product
An5506-04-fa Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27168 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27167 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters are generated in init_3bb_password in libci_adaptation_layer.so.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27166 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27165 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27164 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27163 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27162 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27161 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27160 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27159 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27158 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27157 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27156 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address of the br0 interface.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27155 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27154 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27153 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27152 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27151 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27150 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27149 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27148 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27147 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27146 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27145 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27144 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27143 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27142 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions.
Product
Hg6245d Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pierrekim.github.io pierrekim.github.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.