Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42 results
Oct 9, 2026Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file.CVE-2026-39460 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Navigating to a certain URL on the switch’s web server causes the switch to reboot.CVE-2026-39453 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govHigh 8.5
Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware oCVE-2026-33367 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentialsCVE-2026-33272 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govMedium 6.8
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-32645 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.2
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device.CVE-2026-29797 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govHigh 8.4
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption.CVE-2026-28745 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user toCVE-2025-26863 · Other software · reported by secure@intel.comMedium 4.8
Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user toCVE-2025-26697 · Other software · reported by secure@intel.comMedium 4.8
Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated userCVE-2025-25273 · Other software · reported by secure@intel.comHigh 8.8
Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentiCVE-2025-24486 · Other software · reported by secure@intel.comHigh 8.8
Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentiCVE-2025-21086 · Other software · reported by secure@intel.comMedium 6.9
Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded creCVE-2022-29953 · Other software · Bakerhughes · reported by MITRECritical 9.8
The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.
- Product
- Bently Nevada 3701/40 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon CVE-2020-9061 · Other software · ZooZ · reported by cret@cert.orgMedium 6.5
Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages.
- Product
- ZST10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthCVE-2020-10137 · Other software · Silicon Labs · reported by cret@cert.orgMedium 6.5
Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthenticated attacker to inject a FIND_NODE_IN_RANGE frame with an invalid random payload, denying service by blocking the processing of upcoming events.
- Product
- UZB-7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Out-of-bounds write in the firmware for Intel(R) Ethernet 700 Series Controllers before version 8.2 may allow a privileged user to potentially enable an escalatCVE-2021-0200 · Other software · Intel · reported by secure@intel.comMedium 6.7
Out-of-bounds write in the firmware for Intel(R) Ethernet 700 Series Controllers before version 8.2 may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Ethernet Controller V710-at2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Nov 12, 2020Improper buffer restrictions in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of priCVE-2020-8693 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper buffer restrictions in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
- Product
- V710-at2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Insufficient access control in the firmware of the Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enableCVE-2020-8692 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insufficient access control in the firmware of the Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
- Product
- V710-at2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020A logic issue in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or dCVE-2020-8691 · Other software · Intel · reported by secure@intel.comMedium 6.7
A logic issue in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
- Product
- V710-at2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Protection mechanism failure in Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privCVE-2020-8690 · Other software · Intel · reported by secure@intel.comMedium 6.7
Protection mechanism failure in Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
- Product
- V710-at2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient access control in firmware Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow a privileged user to potentially enable a denial CVE-2019-0150 · Other software · Intel · reported by secure@intel.comMedium 5.1
Insufficient access control in firmware Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow a privileged user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially CVE-2019-0149 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of CVE-2019-0148 · Other software · Intel · reported by secure@intel.comMedium 5.5
Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enaCVE-2019-0147 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial CVE-2019-0146 · Other software · Intel · reported by secure@intel.comMedium 5.5
Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalatCVE-2019-0145 · Other software · Intel · reported by secure@intel.comHigh 7.8
Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Unhandled exception in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an authenticated user to potentially enable a denial oCVE-2019-0144 · Other software · Intel · reported by secure@intel.comMedium 6.5
Unhandled exception in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Unhandled exception in Kernel-mode drivers for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enablCVE-2019-0143 · Other software · Intel · reported by secure@intel.comMedium 5.5
Unhandled exception in Kernel-mode drivers for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient access control in ilp60x64.sys driver for Intel(R) Ethernet 700 Series Controllers before version 1.33.0.0 may allow a privileged user to potentialCVE-2019-0142 · Other software · Intel · reported by secure@intel.comHigh 8.2
Insufficient access control in ilp60x64.sys driver for Intel(R) Ethernet 700 Series Controllers before version 1.33.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Buffer overflow in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an unauthenticated user to potentially enable an escalatioCVE-2019-0140 · Other software · Intel · reported by secure@intel.comHigh 8.8
Buffer overflow in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an unauthenticated user to potentially enable an escalation of privilege via an adjacent access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient access control in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow a privileged user to potentially enable an escCVE-2019-0139 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insufficient access control in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow a privileged user to potentially enable an escalation of privilege, denial of service, or information disclosure via local access.
- Product
- Ethernet Controller X710-tm4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comintel.com
Mar 8, 2019A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating systemCVE-2019-1607 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3).
- Product
- Nexus 7000 and 7700 Series Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Mar 8, 2019A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an CVE-2019-1604 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check of user accounts and their associated Group ID (GID). An attacker could exploit this vulnerability by taking advantage of a logic error that will permit the use of higher privileged commands than what is necessarily assigned. A successful exploit could allow an attacker to execute commands with elevated privileges on the underlying Linux shell of an affected device. Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 8.2(3), and 8.3(2). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
- Product
- Nexus 7000 and 7700 Series Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Apr 19, 2018A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devicCVE-2018-0239 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devices and Virtualized Packet Core (VPC) System Software could allow an unauthenticated, remote attacker to cause an interface on the device to cease forwarding packets. The device may need to be manually reloaded to clear this Interface Forwarding Denial of Service condition. The vulnerability is due to the failure to properly check that the length of a packet to transmit does not exceed the maximum supported length of the network interface card (NIC). An attacker could exploit this vulnerability by sending a crafted IP packet or a series of crafted IP fragments through an interface on the targeted device. A successful exploit could allow the attacker to cause the network interface to cease forwarding packets. This vulnerability could be triggered by either IPv4 or IPv6 network traffic. This vulnerability affects the following Cisco products when they are running the StarOS operating system and a virtual interface card is installed on the device: Aggregation Services Router (ASR) 5700 Series, Virtualized Packet Core-Distributed
- Product
- Staros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 30, 2018Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, CVE-2014-4705 · Other software · Huawei · reported by MITREHigh 7.5
Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, AR160, AR200, AR1200, AR2200, AR3200, AR530, NetEngine16EX, SRG1300, SRG2300, and SRG3300 series routers; and WLAN AC6005, AC6605, and ACU2 access controllers allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
- Product
- S9300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2017A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series CVE-2017-12340 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.2
A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series Switches could allow an authenticated, local attacker to access the Bash shell of an affected device's operating system, even if the Bash shell is disabled on the system. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain functions of the Python scripting sandbox of the affected system. An attacker could exploit this vulnerability to escape the scripting sandbox and enter the Bash shell of the operating system with the privileges of the authenticated user for the affected system. To exploit this vulnerability, the attacker must have local access to the affected system and be authenticated to the affected system with administrative or Python execution privileges. Cisco Bug IDs: CSCvd86513.
- Product
- Nx-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Jul 5, 2017A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series dCVE-2017-6707 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.2
A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series devices and Cisco Virtualized Packet Core (VPC) Software could allow an authenticated, local attacker to break from the StarOS CLI of an affected system and execute arbitrary shell commands as a Linux root user on the system, aka Command Injection. The vulnerability exists because the affected operating system does not sufficiently sanitize commands before inserting them into Linux shell commands. An attacker could exploit this vulnerability by submitting a crafted CLI command for execution in a Linux shell command as a root user. Cisco Bug IDs: CSCvc69329, CSCvc72930.
- Product
- Staros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Mar 4, 2016Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.CVE-2016-2243 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.9
Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.
- Product
- 700 Series Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comh20565.www2.hp.com
Aug 1, 2013Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remote attackers to bypassCVE-2013-4652 · Other software · Siemens · reported by MITREHigh 10
Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remote attackers to bypass authentication and execute arbitrary code via a (1) SSH or (2) TELNET connection.
- Product
- Scalance W700 Series Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiemens.comsiemens.com
Aug 1, 2013Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easiCVE-2013-4651 · Other software · Siemens · reported by MITREMedium 6.6
Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
- Product
- Scalance W700 Series Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiemens.comsiemens.com
Dec 19, 2006The NeoScale Systems CryptoStor 700 series appliance before 2.6 relies on client-side ActiveX code for smartcard authentication, which allows remote attackers tCVE-2006-3896 · Other software · Neoscale Systems · reported by cret@cert.orgMedium 4.9
The NeoScale Systems CryptoStor 700 series appliance before 2.6 relies on client-side ActiveX code for smartcard authentication, which allows remote attackers to bypass smartcard authentication, and gain access if able to present a valid username and password, by disabling ActiveX.
- Product
- Cryptostor Tape 700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Oct 13, 2006Cisco 2700 Series Wireless Location Appliances before 2.1.34.0 have a default administrator username "root" and password "password," which allows remote attackeCVE-2006-5288 · Network & remote access · Cisco · reported by MITREHigh 10
Cisco 2700 Series Wireless Location Appliances before 2.1.34.0 have a default administrator username "root" and password "password," which allows remote attackers to obtain administrative privileges, aka Bug ID CSCsb92893.
- Product
- 2700 Wireless Location Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comcisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.