Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
402 results · page 3 of 9
Jul 8, 2024A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623.CVE-2023-46685 · Other software · LevelOne · reported by talos-cna@cisco.comCritical 9.8
A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution.
- Product
- WBR-6013
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
May 28, 2024Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account.CVE-2023-43845 · Other software · aten · reported by MITRECritical 9.8
Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to the telnet console and gain administrator privileges.
- Product
- pe6208
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2024A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9.CVE-2024-21785 · Other software · AutomationDirect · reported by talos-cna@cisco.comCritical 9.8
A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of network requests can lead to unauthorized access. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- P3-550E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.automationdirect.comtalosintelligence.com
May 24, 2024TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to logCVE-2024-35396 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root.
- Product
- cp900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.CVE-2024-34219 · Other software · totolink · reported by MITREHigh 8.6
TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.
- Product
- cp450_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024D-Link DAP-2622 Telnet CLI Command Injection Remote Code Execution Vulnerability.CVE-2023-44416 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comMedium 6.8
D-Link DAP-2622 Telnet CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622. Authentication is required to exploit this vulnerability. The specific flaw exists within the CLI service, which listens on TCP port 23. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20051.
- Product
- DAP-2622
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024NETGEAR RAX30 Telnet CLI passwd Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-40478 · Network & remote access · NETGEAR · reported by zdi-disclosures@trendmicro.comMedium 6.8
NETGEAR RAX30 Telnet CLI passwd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the telnet CLI service, which listens on TCP port 23. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20009.
- Product
- RAX30
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comzerodayinitiative.com
May 2, 2024D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability.CVE-2023-35724 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comHigh 8.8
D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CLI service, which listens on TCP port 23. The server program contains hard-coded credentials. An attacker can leverage this vulnerability to bypass authentication on the system. . Was ZDI-CAN-20050.
- Product
- DAP-2622
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comzerodayinitiative.com
Apr 8, 2024TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg fuCVE-2024-31805 · Other software · totolink · reported by MITREMedium 6.5
TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg function.
- Product
- ex200_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account.CVE-2024-28093 · Other software · adtran · reported by MITREHigh 8.8
The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account.
- Product
- netvanta_3120_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTelCVE-2023-52026 · Other software · totolink · reported by MITRECritical 9.8
TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTelnetCfg interface
- Product
- ex1800t
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record815yang.github.io815yang.github.io
Dec 26, 2023Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.CVE-2023-51094 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.
- Product
- M3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.CVE-2023-49409 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
- Product
- Ax3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.CVE-2023-49406 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as thCVE-2023-41030 · Other software · Juplink · reported by disclosures@exodusintel.comMedium 6.3
Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as the 'user' user.
- Product
- RX4-1500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Aug 28, 2023An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection.CVE-2023-34725 · Other software · techview · reported by MITREMedium 6.8
An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection.
- Product
- la-5570_wireless_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploitsecurity.io
Jul 5, 2023Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.CVE-2022-46080 · Other software · nexxtsolutions · reported by MITRECritical 9.8
Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.
- Product
- nebula1200-ac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnexxtsolutions.com
Jul 3, 2023Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.CVE-2023-22906 · Other software · heroelectronix · reported by MITREHigh 8.8
Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.
- Product
- qubo_hcd01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default passwoCVE-2023-30603 · Other software · Hitron Technologies Inc. · reported by twcert@cert.org.twCritical 9.8
Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the administrator’s privilege, resulting in performing arbitrary system operation or disrupt service.
- Product
- Hitron CODA-5310
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 2, 2023Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext.CVE-2023-30602 · Other software · Hitron Technologies Inc. · reported by twcert@cert.org.twHigh 7.5
Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to access credentials of normal users and administrator.
- Product
- Hitron CODA-5310
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 11, 2023 Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP CVE-2023-1834 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.4
Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP ports open by default. This could potentially allow attackers unauthorized access to the device through the open ports.
- Product
- Kinetix 5500 EtherNet/IP Servo Drive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comcisa.gov
Mar 30, 2023A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted userCVE-2023-27533 · Other software · Siemens · reported by support@hackerone.comHigh 8.8
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.debian.org
Mar 23, 2023A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,CVE-2022-28493 · Other software · Totolink · reported by MITRECritical 9.8
A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,
- Product
- Cp900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5.CVE-2022-38452 · Network & remote access · Netgear · reported by talos-cna@cisco.comHigh 7.2
A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
- Product
- Orbi Router RBR750
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comtalosintelligence.com
Mar 1, 2023SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for deviCVE-2023-0053 · Other software · SAUTER Controls · reported by ics-cert@hq.dhs.govHigh 7.5
SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system.
- Product
- Nova 220 (EYK220F001) DDC with BACnet connection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.CVE-2022-46637 · Other software · Prolink2u · reported by MITRECritical 9.8
Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.
- Product
- Prs1841 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xsp.compacketstormsecurity.com
Feb 11, 2023A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitCVE-2023-0127 · Other software · Dlink · reported by vulnreport@tenable.comHigh 7.8
A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
- Product
- Dwl-2600ap Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 3, 2023TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.CVE-2023-24155 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.
- Product
- T8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.CVE-2023-24147 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.
- Product
- Ca300-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request.CVE-2022-48113 · Other software · Totolink · reported by MITRECritical 9.8
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
- Product
- N200re-v5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwefir.blogspot.comwefir.blogspot.com
Jan 6, 2023The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host fieldCVE-2022-44149 · Other software · Nexxtsolutions · reported by MITREHigh 8.8
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
- Product
- Amp300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 16, 2022The default console presented to users over telnet (when enabled) is restricted to a subset of commands.CVE-2022-47210 · Network & remote access · Netgear · reported by vulnreport@tenable.comHigh 7.8
The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
- Product
- Rax30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 8, 2022An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.CVE-2022-44932 · Network & remote access · Tenda · reported by MITREHigh 7.5
An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
- Product
- A18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and booCVE-2022-43366 · Other software · Ip-com · reported by MITREHigh 7.5
IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and boot interfaces.
- Product
- Ew9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc.CVE-2022-29889 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 21, 2022On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled.CVE-2022-3203 · Other software · ORing · reported by info@cert.vde.comCritical 9.8
On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
- Product
- IAP-420(+)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmads.uniud.itmads.uniud.it
Oct 18, 2022An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTesterCVE-2022-33872 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell.
- Product
- Fortinet FortiTester
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 18, 2022An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 CVE-2022-35846 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.1
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack.
- Product
- Fortinet FortiTester
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Sep 19, 2022This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service.CVE-2022-23768 · Other software · Neo Information Systems Co., Ltd · reported by vuln@krcert.or.krHigh 8.8
This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device.
- Product
- Home AP NIS-HAP11AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Sep 8, 2022Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execCVE-2022-38394 · Other software · Allied Telesis K.K. · reported by vultures@jpcert.or.jpCritical 9.8
Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execute an arbitrary OS command.
- Product
- CentreCOM AR260S V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpallied-telesis.co.jp
Sep 8, 2022OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to CVE-2022-38094 · Other software · Allied Telesis K.K. · reported by vultures@jpcert.or.jpHigh 8.8
OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
- Product
- CentreCOM AR260S V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpallied-telesis.co.jp
Sep 8, 2022Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticaCVE-2022-34869 · Other software · Allied Telesis K.K. · reported by vultures@jpcert.or.jpHigh 8.8
Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
- Product
- CentreCOM AR260S V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpallied-telesis.co.jp
Aug 30, 2022telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8.CVE-2022-39028 · Other software · GNU · reported by MITREHigh 7.5
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
- Product
- Inetutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.hadrons.orglists.debian.org
Aug 28, 2022D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.CVE-2022-38557 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
- Product
- Dir-845l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.CVE-2022-38556 · Other software · Trendnet · reported by MITRECritical 9.8
Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
- Product
- Tew733gr Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh.CVE-2022-36524 · Other software · Dlink · reported by MITREHigh 7.5
D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh.
- Product
- Go-rt-ac750 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdlink.com
Jul 25, 2022An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.CVE-2022-34572 · Other software · Wavlink · reported by MITREMedium 5.7
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.
- Product
- Wifi-repeater Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm.CVE-2022-30918 · Other software · H3c · reported by MITRECritical 9.8
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm.
- Product
- Magic R100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm.CVE-2022-30916 · Other software · H3c · reported by MITRECritical 9.8
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm.
- Product
- Magic R100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.CVE-2021-42892 · Other software · Totolink · reported by MITREMedium 4.3
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.