Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
50 results
Aug 23, 2026A vulnerability has been found in Tenda CH22 1.0.0.1.CVE-2026-78141 · Network & remote access · Tenda · reported by VulDBLow 2.1
A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Aug 23, 2026A security flaw has been discovered in Tenda CH22 1.0.0.1.CVE-2026-78063 · Network & remote access · Tenda · reported by VulDBLow 2.1
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Aug 20, 2026A vulnerability has been found in Tenda CH22 1.0.0.1.CVE-2026-77031 · Network & remote access · Tenda · reported by VulDBLow 2.1
A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Aug 9, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-19346 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jul 13, 2026A vulnerability was found in Tenda CH22 1.0.0.1.CVE-2026-15543 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Apr 9, 2026A vulnerability was detected in Tenda CH22 1.0.0.6(468).CVE-2026-5962 · Network & remote access · Tenda · reported by VulDBMedium 5.5
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A weakness has been identified in Tenda CH22 1.0.0.1.CVE-2026-5605 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A weakness has been identified in Tenda CH22 1.0.0.1. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A security flaw has been discovered in Tenda CH22 1.0.0.1.CVE-2026-5604 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formCertLocalPrecreate of the file /goform/CertLocalPrecreate of the component Parameter Handler. Performing a manipulation of the argument standard results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-5204 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-5156 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This impacts the function formQuickIndex of the file /goform/QuickIndex of the component Parameter Handler. This manipulation of the argument mit_linktype causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A vulnerability was found in Tenda CH22 1.0.0.1.CVE-2026-5155 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A vulnerability has been found in Tenda CH22 1.0.0.1/1.If.CVE-2026-5154 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The impacted element is the function fromSetCfm of the file /goform/setcfm of the component Parameter Handler. The manipulation of the argument funcname leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw has been found in Tenda CH22 1.0.0.1.CVE-2026-5153 · Network & remote access · Tenda · reported by VulDBLow 2.1
A flaw has been found in Tenda CH22 1.0.0.1. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. Executing a manipulation of the argument mac can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A vulnerability was detected in Tenda CH22 1.0.0.1.CVE-2026-5152 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/createFileName. Performing a manipulation of the argument fileNameMit results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025A vulnerability has been found in Tenda CH22 up to 1.0.0.1.CVE-2025-15229 · Network & remote access · Tenda · reported by VulDBMedium 5.5
A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClient. Such manipulation of the argument LISTLEN leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025A weakness has been identified in Tenda CH22 1.0.0.1.CVE-2025-15076 · Network & remote access · Tenda · reported by VulDBMedium 5.5
A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A security flaw has been discovered in Tenda CH22 1.0.0.1.CVE-2025-14526 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025A vulnerability was detected in Tenda CH22 1.0.0.1.CVE-2025-13400 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing a manipulation of the argument chkHz results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025A security vulnerability has been detected in Tenda CH22 1.0.0.1.CVE-2025-13288 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A flaw has been found in Tenda CH22 1.0.0.1.CVE-2025-12322 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a manipulation of the argument page can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A security vulnerability has been detected in Tenda CH22 1.0.0.1.CVE-2025-12274 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A weakness has been identified in Tenda CH22 1.0.0.1.CVE-2025-12273 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A security flaw has been discovered in Tenda CH22 1.0.0.1.CVE-2025-12272 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation of the argument page results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was identified in Tenda CH22 1.0.0.1.CVE-2025-12271 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A weakness has been identified in Tenda CH22 1.0.0.1.CVE-2025-12265 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-12236 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was found in Tenda CH22 1.0.0.1.CVE-2025-12235 · Network & remote access · Tenda · reported by VulDBHigh 7.3
A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability has been found in Tenda CH22 1.0.0.1.CVE-2025-12234 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A flaw has been found in Tenda CH22 1.0.0.1.CVE-2025-12233 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was detected in Tenda CH22 1.0.0.1.CVE-2025-12232 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A vulnerability was found in Tenda CH22 1.0.0.1.CVE-2025-11423 · Network & remote access · Tenda · reported by VulDBHigh 8.9
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation of the argument page results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1.CVE-2025-11418 · Network & remote access · Tenda · reported by VulDBHigh 8.9
A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP Request Handler. The manipulation of the argument mit_ssid_index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-11117 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025A vulnerability was identified in Tenda CH22 1.0.0.1.CVE-2025-9813 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-9812 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-9748 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A flaw has been found in Tenda CH22 1.0.0.1.CVE-2025-9443 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation of the argument new_account can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025A vulnerability has been found in Tenda CH22 1.0.0.1.CVE-2025-9007 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was identified in Tenda CH22 1.0.0.1.CVE-2025-9006 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/delFileName. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1.CVE-2025-8180 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formdeleteUserName of the file /goform/deleteUserName. The manipulation of the argument old_account leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.1.CVE-2025-5685 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.1. This affects the function formNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1.CVE-2025-5619 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. This issue affects the function formaddUserName of the file /goform/addUserName. The manipulation of the argument Password leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.CVE-2024-46045 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.
- Product
- ch22_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.CVE-2024-46044 · Network & remote access · tenda · reported by MITRECritical 9.8
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.
- Product
- ch22_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2018There is an authentication bypass vulnerability in some Huawei servers.CVE-2018-7943 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication by some special operations. Due to insufficient authentication, an attacker may exploit the vulnerability to get some sensitive information and high-level users' privilege.
- Product
- 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2018The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation.CVE-2018-7951 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
- Product
- 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2018The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation.CVE-2018-7950 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
- Product
- 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2018The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability.CVE-2018-7949 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 8.8
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
- Product
- 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2018The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability.CVE-2018-7942 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.5
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. An unauthenticated, remote attacker may send some specially crafted messages to the affected products. Due to improper authentication design, successful exploit may cause some information leak.
- Product
- 1288H V5; 2288H V5; 2488 V5; CH121 V3; CH121L V3; CH121L V5; CH121 V5; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5; RH1288 V3; RH2288 V3; RH2288
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comexchange.xforce.ibmcloud.com
Apr 13, 2017SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521,CVE-2016-7834 · Other software · Sony · reported by vultures@jpcert.or.jpHigh 8.8
SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521, SNC-ZB550, SNC-ZM550, SNC-ZM551, SNC-EP550, SNC-EP580, SNC-ER550, SNC-ER550C, SNC-ER580, SNC-ER585, SNC-ER585H, SNC-ZP550, SNC-ZR550, SNC-EP520, SNC-EP521, SNC-ER520, SNC-ER521, SNC-ER521C network cameras with firmware before Ver.1.86.00 and SONY SNC-CX600, SNC-CX600W, SNC-EB600, SNC-EB600B, SNC-EB602R, SNC-EB630, SNC-EB630B, SNC-EB632R, SNC-EM600, SNC-EM601, SNC-EM602R, SNC-EM602RC, SNC-EM630, SNC-EM631, SNC-EM632R, SNC-EM632RC, SNC-VB600, SNC-VB600B, SNC-VB600B5, SNC-VB630, SNC-VB6305, SNC-VB6307, SNC-VB632D, SNC-VB635, SNC-VM600, SNC-VM600B, SNC-VM600B5, SNC-VM601, SNC-VM601B, SNC-VM602R, SNC-VM630, SNC-VM6305, SNC-VM6307, SNC-VM631, SNC-VM632R, SNC-WR600, SNC-WR602, SNC-WR602C, SNC-WR630, SNC-WR632, SNC-WR632C, SNC-XM631, SNC-XM632, SNC-XM636, SNC-XM637, SNC-VB600L, SNC-VM600L, SNC-XM631L, SNC-WR602CL network cameras with firmware before Ver.2.7.2 are prone to sensitive information disclosure. This may allow an attacker on the same local network segment to login to the device with administrative privileges and perform o
- Product
- SNC Series Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.