Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,867 results · page 28 of 38
Dec 5, 2022Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote code execution as root CVE-2022-40918 · Other software · Force1rc · reported by MITRECritical 9.8
Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote code execution as root user via a specially crafted UDP packet. Please update the Reference section to these links > http://thiscomputer.com/ > https://www.bostoncyber.org/ > https://medium.com/@meekworth/exploiting-the-lw9621-drone-camera-module-773f00081368
- Product
- Discovery Wifi U818a Hd+ FPV Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record1af95112-6fd8-4c8f-8bd6-c47f8ef7b77a.filesusr.commedium.com
Dec 5, 2022PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authenticatioCVE-2022-45479 · Other software · BEAppsMobile · reported by disclosure@synopsys.comCritical 9.8
PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Product
- PC Keyboard WiFi & Bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Dec 2, 2022Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterGet function.CVE-2022-45669 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterGet function.
- Product
- I22 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.CVE-2022-45663 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.
- Product
- I22 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.CVE-2022-45660 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function.CVE-2022-45658 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set function.CVE-2022-45655 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the ssid parameter in the form_fast_setting_wifi_set function.CVE-2022-45654 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.CVE-2022-45645 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function.CVE-2022-45643 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresseCVE-2022-45480 · Other software · Telepad · reported by disclosure@synopsys.comMedium 5.9
PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Product
- PC Keyboard WiFi & Bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Dec 1, 2022A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.CVE-2022-3713 · Network & remote access · Sophos · reported by security-alert@sophos.comHigh 8.8
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.CVE-2022-44183 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.CVE-2022-44180 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.CVE-2022-44177 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.CVE-2022-44171 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially enable denial of servCVE-2022-28667 · Other software · Intel · reported by secure@intel.comMedium 6.5
Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- Wi-fi 6e Ax411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potentiCVE-2022-26047 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potentially enable denial of service via local access.
- Product
- Killer Wifi Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function.CVE-2022-43106 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function.
- Product
- Ac23 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.CVE-2022-43105 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
- Product
- Ac23 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-35877 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` configuration parameter, as used within the `testWifiAP` XCMD handler
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-35876 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` configuration parameters, as used within the `testWifiAP` XCMD handler
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-35875 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk` configuration parameter, as used within the `testWifiAP` XCMD handler
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-35874 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid` and `ssid_hex` configuration parameters, as used within the `testWifiAP` XCMD handler
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-33195 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 10
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_DefaultKeyID` in the function located at offset `0x1c7d28` of firmware 6.9Z, and even more specifically on the command execution occuring at offset `0x1c7fac`.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-33194 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 10
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_Key` and `WL_DefaultKeyID` configuration values in the function located at offset `0x1c7d28` of firmware 6.9Z , and even more specifically on the command execution occuring at offset `0x1c7f6c`.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-33193 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 10
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability specifically focuses on the unsafe use of the `WL_WPAPSK` configuration value in the function located at offset `0x1c7d28` of firmware 6.9Z.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.CVE-2022-33192 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 10
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability specifically focuses on the unsafe use of the `WL_SSID` and `WL_SSID_HEX` configuration values in the function at offset `0x1c7d28` of firmware 6.9Z.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 18, 2022Tenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function.CVE-2022-43259 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Oct 17, 2022Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart.CVE-2022-42170 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/addWifiMacFilter.CVE-2022-42169 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/addWifiMacFilter.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet.CVE-2022-42079 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet.
- Product
- Ac1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via imCVE-2022-39864 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.
- Product
- SmartThings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 27, 2022Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (aCVE-2021-27862 · Other software · IEEE · reported by cret@cert.orgMedium 4.7
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).
- Product
- 802.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.champtar.frdatatracker.ietf.org
Sep 23, 2022Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function.CVE-2022-40105 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Product
- I9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function.CVE-2022-40101 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Product
- I9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_setCVE-2022-40854 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSchedWifi/CVE-2022-40865 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSchedWifi/
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_setCVE-2022-40853 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_set
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware.CVE-2022-37235 · Network & remote access · Netgear · reported by MITRECritical 9.8
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncat
- Product
- R7000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware.CVE-2022-37234 · Network & remote access · Netgear · reported by MITREHigh 7.8
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncpy.
- Product
- R7000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.CVE-2022-38956 · Network & remote access · Netgear · reported by MITREMedium 5.3
An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to replace the user-uploaded firmware image with an original old firmware image. This affects Firmware 1.1.1_1.1.9 and earlier.
- Product
- Wpn824ext Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.CVE-2022-38955 · Network & remote access · Netgear · reported by MITREHigh 7.5
An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the CRC check. A successful attack can either introduce a backdoor to the device or make the device DoS. This affects Firmware Version: 1.1.1_1.1.9.
- Product
- Wpn824ext Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can resultCVE-2022-3218 · Other software · Necta LLC · reported by cve@rapid7.comCritical 9.8
Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.
- Product
- WiFi Mouse (Mouse Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 19, 2022Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetWifiGusetBasic.CVE-2022-40076 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetWifiGusetBasic.
- Product
- Ac21 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, form_fast_setting_wifi_set.CVE-2022-40075 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, form_fast_setting_wifi_set.
- Product
- Ac21 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, setSchedWifi.CVE-2022-40074 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, setSchedWifi.
- Product
- Ac21 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the page parameter at /goformCVE-2022-38326 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the filePath parameter at /goCVE-2022-38325 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the filePath parameter at /goform/expandDlnaFile.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass.CVE-2022-20398 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-221859734
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.