Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,867 results · page 25 of 38
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38445 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38444 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38443 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38442 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38441 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38440 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38439 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38438 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38437 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38436 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33918 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33917 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33916 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.'CVE-2023-40844 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.'
- Product
- ac6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.CVE-2023-41555 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.
- Product
- ac7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter wpapsk_crypto at url /goform/WifiExtraSet.CVE-2023-41554 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter wpapsk_crypto at url /goform/WifiExtraSet.
- Product
- ac9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set.CVE-2023-40915 · Network & remote access · tenda · reported by MITREHigh 7.5
Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter.
- Product
- ax3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter schedStartTime and schedEndTime at /goform/openSchedWifi.CVE-2023-40892 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter schedStartTime and schedEndTime at /goform/openSchedWifi.
- Product
- ac8v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2023A stack-based buffer overflow exists in Juplink RX4-1500, a WiFi router, in versions 1.0.2 through 1.0.5.CVE-2023-41028 · Other software · Juplink · reported by disclosures@exodusintel.comCritical 9
A stack-based buffer overflow exists in Juplink RX4-1500, a WiFi router, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root.
- Product
- RX4-1500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Aug 23, 2023Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen.CVE-2023-40282 · Other software · Rakuten Mobile, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a result, sensitive information may be obtained and/or the settings may be changed.
- Product
- Rakuten WiFi Pocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpnetwork.mobile.rakuten.co.jp
Aug 14, 2023In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and iCVE-2023-21230 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and its BSSID or SSID due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 14, 2023Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.CVE-2023-39828 · Network & remote access · tenda · reported by MITREHigh 7.5
Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
- Product
- a18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can CVE-2023-29468 · Other software · TI · reported by MITRECritical 9.8
The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code execution. This affects WILINK8-WIFI-MCP8 version 8.5_SP3 and earlier.
- Product
- Wilink8-wifi-mcp8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2023Vulnerability of API privilege escalation in the wifienhance module.CVE-2023-39394 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Aug 13, 2023Vulnerability of insecure signatures in the ServiceWifiResources module.CVE-2023-39393 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be maliciously modified and overwritten.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Aug 10, 2023Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user tCVE-2023-28714 · Other software · intel_proset_wireless_wifi_software_for_windows · reported by secure@intel.comHigh 8.2
Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- intel_proset_wireless_wifi_software_for_windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via localCVE-2022-46329 · Other software · Intel · reported by secure@intel.comHigh 8.2
Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Killer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Aug 10, 2023Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privCVE-2022-40964 · Other software · Intel · reported by secure@intel.comHigh 7.9
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Killer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Aug 10, 2023Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation ofCVE-2022-38076 · Other software · Intel · reported by secure@intel.comLow 3.8
Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Killer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Aug 10, 2023Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of sCVE-2022-36351 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- Killer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Aug 10, 2023Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privCVE-2022-27635 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Killer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Aug 9, 2023PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.CVE-2023-30701 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.7
PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 9, 2023PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider withCVE-2023-30700 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider without proper permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 8, 2023TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so.CVE-2023-40041 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.
- Product
- t10_v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_CVE-2023-38940 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- Product
- f1203
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at genie_ap_wifi_change.cgi.CVE-2023-36499 · Network & remote access · netgear · reported by MITREHigh 8.8
Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at genie_ap_wifi_change.cgi.
- Product
- xr300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33911 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection.CVE-2023-34635 · Other software · Wifi-soft · reported by MITRECritical 9.8
Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page.
- Product
- Unibox Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jul 30, 2023 Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.CVE-2023-37214 · Other software · Heights Telecom · reported by cna@cyber.gov.ilCritical 9.8
Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.
- Product
- ERO1xS-Pro Dual-Band WiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.CVE-2023-3548 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.3
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.
- Product
- IQ Wifi 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 20, 2023A vulnerability was found in Dooblou WiFi File Explorer 1.13.3.CVE-2023-3784 · Other software · Dooblou · reported by VulDBLow 3.5
A vulnerability was found in Dooblou WiFi File Explorer 1.13.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument search/order/download/mode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235051.
- Product
- WiFi File Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in Webile 1.0.1.CVE-2023-3783 · Other software · Webile Wifi PC File Transfer Project · reported by VulDBLow 3.5
A vulnerability was found in Webile 1.0.1. It has been classified as problematic. Affected is an unknown function of the component HTTP POST Request Handler. The manipulation of the argument new_file_name/c leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-235050 is the identifier assigned to this vulnerability.
- Product
- Webile Wifi PC File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series CVE-2023-34139 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 8.8
A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.
- Product
- USG FLEX series firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permCVE-2023-21248 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 10, 2023Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.CVE-2023-37701 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
- Product
- fh1203
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.CVE-2023-37700 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- Product
- fh1203
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023In multiple functions of WifiNetworkFactory.java, there is a missing permission check.CVE-2023-21185 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-266700762
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto.CVE-2023-21179 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-272755865
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass.CVE-2023-21172 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262243015
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 26, 2023Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the deviceId parameter iCVE-2022-40010 · Network & remote access · Tenda · reported by MITREMedium 5.4
Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the deviceId parameter in the Parental Control module.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.