VARIoT IoT exploits database

D-Link DWL-2600AP - Multiple OS Command Injection. CVE-2019-20499CVE-2019-20500CVE-2019-20501 . webapps exploit for Hardware platform

Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection. CVE-2018-7841 . webapps exploit for PHP platform

Intelbras IWR 3000N - Denial of Service (Remote Reboot). CVE-2019-11415 . dos exploit for Hardware platform

Intelbras IWR 3000N 1.5.0 - Cross-Site Request Forgery. CVE-2019-11416 . webapps exploit for Hardware platform

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a arbitrary setting writes, resulting in the unverified changes to any system setting. An attacker can make an authenticated HTTP request, or run the binary as any user, to trigger this vulnerability.

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the device. An attacker can make an authenticated HTTP request to trigger this vulnerability.

An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker can listen to network traffic upstream from the device to capitalize on this vulnerability.

ASUS HG100 - Denial of Service. CVE-2018-11492 . dos exploit for Hardware platform

Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting. CVE-2019-9955 . webapps exploit for Hardware platform

Cisco RV130W 1.0.3.44 - Remote Stack Overflow. CVE-2019-1663 . remote exploit for Hardware platform

D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting. CVE-2019-11017 . webapps exploit for Hardware platform

Verizon Fios Quantum Gateway is prone to a command-injection vulnerability. An attacker can exploit this issue to execute arbitrary commands with root privileges ; this may aid in further attacks. Verizon Fios Quantum Gateway 02.01.00.05 is vulnerable; other versions may also be affected.

Fortinet FortiSandbox is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to perform unauthorized actions such as reading, modifying, or deleting content on behalf of the victim on the SharePoint site.

Advantech WebAccess is prone to the following security vulnerabilities: 1. An arbitrary file-download vulnerability 2. An arbitrary file-upload vulnerability An attacker can exploit these issues to execute arbitrary code in the context of the application, modify and delete files and perform certain unauthorized actions. This may aid in further attacks. Advantech WebAccess 8.3.4 is vulnerable; other versions may also be affected.

Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting. CVE-2019-9556 . webapps exploit for Hardware platform

Teracue ENC-400 - Command Injection / Missing Authentication. CVE-2018-20220CVE-2018-20219CVE-2018-20218 . webapps exploit for Hardware platform

Cisco Network Convergence System 1000 Series is prone to a directory-traversal vulnerability. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. This issue is tracked by Cisco Bug ID CSCvk32415.

Indusoft Web Studio 8.1 SP2 - Remote Code Execution. CVE-2019-6545CVE-2019-6543 . remote exploit for Multiple platform

Multiple D-Link Products are prone to a command-injection vulnerability. Exploiting this issue could allow an attacker to execute arbitrary commands in the context of the affected device. Failed exploit attempts will likely result in denial-of-service conditions. D-Link DIR-823G devices with firmware through 1.02B03 are vulnerable.

D-Link DIR-823G Router is prone to a remote security vulnerability. An attacker can leverage this issue to perform unauthorized actions. This may aid in further attacks. D-Link DIR-823G with firmware 1.02B03 version is vulnerable; other versions may also be affected.