VARIoT latest news about IoT security

Cisco: Security devices are vulnerable to SNIcat data exfiltration technique - The Record by Recorded Future Trust: 3.75 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Aug. 19, 2021, 2:13 a.m.	Vulnerabilities: -

Affected products

External IDs

vendor:	check point	model:	check point
vendor:	palo alto networks	model:	palo alto networks
vendor:	palo alto networks	model:	networks
vendor:	palo	model:	palo alto networks
vendor:	palo	model:	networks
vendor:	cisco	model:	industrial security appliance
vendor:	cisco	model:	firepower threat defense
vendor:	cisco	model:	firepower
vendor:	cisco	model:	web security appliance

Advisory: Multiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain - IoT Inspector Related entries in the VARIoT vulnerabilities database: VAR-201812-1038, VAR-202001-0633, VAR-201505-0274 Trust: 5.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Aug. 16, 2021, 6:48 a.m.	Vulnerabilities: command execution, code execution, default user account...

Affected products

External IDs

vendor:	mesh	model:	mesh
vendor:	tenda	model:	ac10
vendor:	tenda	model:	router
vendor:	elecom	model:	wrc-300febk-a
vendor:	elecom	model:	wrc-300febk
vendor:	buffalo	model:	wmr-433
vendor:	buffalo	model:	wsr-1166dhp4
vendor:	buffalo	model:	wsr-1166dhp3
vendor:	buffalo	model:	router
vendor:	netgear	model:	router
vendor:	netgear	model:	n300
vendor:	netis	model:	wf2419
vendor:	netis	model:	wf2411
vendor:	compal	model:	networks
vendor:	google	model:	home
vendor:	google	model:	wifi
vendor:	luna	model:	cover
vendor:	buffalo inc	model:	wmr-433
vendor:	buffalo inc	model:	wsr-1166dhp4
vendor:	buffalo inc	model:	wsr-1166dhp3
vendor:	buffalo inc	model:	router
vendor:	trendnet	model:	tew-637ap
vendor:	trendnet	model:	tew-651br
vendor:	trendnet	model:	tew-638apb
vendor:	zyxel	model:	p-330w
vendor:	zyxel	model:	nbg-418n
vendor:	compal broadband networks	model:	networks
vendor:	beeline	model:	smart box
vendor:	unbound	model:	unbound
vendor:	realtek	model:	realtek sdk
vendor:	belkin	model:	n150 wireless router
vendor:	belkin	model:	router
vendor:	belkin	model:	n300
vendor:	belkin	model:	n300 wireless router
vendor:	d-link	model:	dir-600l
vendor:	d-link	model:	dir-605l
vendor:	d-link	model:	dir-825
vendor:	d-link	model:	dir-815
vendor:	d-link	model:	dsl-2640u
vendor:	d-link	model:	dir-615
vendor:	d-link	model:	dvg-n5402sp
vendor:	d-link	model:	dir-842
vendor:	d-link	model:	dap-1360
vendor:	d-link	model:	dir-300
vendor:	d-link	model:	dir-820l
vendor:	d-link	model:	router
vendor:	d-link	model:	dir-619l
vendor:	d-link	model:	dir-809
vendor:	d-link	model:	dsl-2750u
vendor:	goahead	model:	webserver
vendor:	asustek	model:	rt-n10e
vendor:	asustek	model:	router

db:

NVD

ids:

CVE-2018-20057, CVE-2019-19824, CVE-2014-8361

The SSID Stripping Vulnerability: When You Don’t See What You Get Related entries in the VARIoT vulnerabilities database: VAR-202109-0821 Trust: 4.5 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 13, 2021, 5:43 a.m.	Vulnerabilities: format string vulnerability

Affected products

External IDs

vendor:	apple	model:	iphone
vendor:	apple	model:	macos

db:

NVD

ids:

CVE-2021-30800

BlackBerry QNX Cybersecurity Vulnerabilities May Affect Drug Manufacturing Equipment \| FDA Trust: 3.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Aug. 17, 2021, midnight	Vulnerabilities: -

Affected products

External IDs

vendor:

blackberry

model:

blackberry

Flaws in Moxa Railway Devices Could Allow Hackers to Cause Disruptions \| SecurityWeek.Com Trust: 5.5 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Jan. 17, 2022, midnight	Vulnerabilities: cross-site scripting, command injection

Affected products

External IDs

vendor:	moxa	model:	wac-1001
vendor:	moxa	model:	moxa
vendor:	moxa	model:	wac-2004 series
vendor:	moxa	model:	wac-2004

db:

NVD

ids:

CVE-2021-39278, CVE-2021-39279

Attackers Exploit Flaw that Could Impact Millions of Routers, IoT Devices \| eSecurityPlanet Related entries in the VARIoT vulnerabilities database: VAR-202104-0768 Trust: 5.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Aug. 10, 2021, 11:45 p.m.	Vulnerabilities: password guessing, cross-site request forgery, request forgery...

Affected products

External IDs

vendor:	tenda	model:	ac11
vendor:	tenda	model:	router
vendor:	palo	model:	networks
vendor:	palo	model:	palo alto networks
vendor:	cisco	model:	routers
vendor:	cisco	model:	hyperflex
vendor:	cisco	model:	cisco systems
vendor:	cisco	model:	router
vendor:	palo alto networks	model:	networks
vendor:	palo alto networks	model:	palo alto networks
vendor:	cisco systems	model:	routers
vendor:	cisco systems	model:	hyperflex
vendor:	cisco systems	model:	cisco systems
vendor:	cisco systems	model:	router
vendor:	dlink	model:	router

db:

NVD

ids:

CVE-2021-20090

Cars and hospital equipment running Blackberry QNX may be affected by BadAlloc vulnerability \| Malwarebytes Labs Trust: 5.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Aug. 18, 2021, 5:33 p.m.	Vulnerabilities: denial of service, integer overflow, code execution...

Affected products

External IDs

vendor:	serve	model:	serve
vendor:	blackberry	model:	blackberry

db:

NVD

ids:

CVE-2021-22156

Security Researcher Immediately Issues Bypass for Windows 0-Day Vulnerability Patch Related entries in the VARIoT vulnerabilities database: VAR-202108-1005 Trust: 3.0 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Jan. 10, 2022, midnight	Vulnerabilities: privilege elevation

Affected products

External IDs

db:

NVD

ids:

CVE-2021-34484

Exposure score in threat and vulnerability management \| Microsoft Docs Trust: 3.0 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Nov. 24, 2021, 6:41 p.m.	Vulnerabilities: -

Affected products

External IDs

vendor:

trend

model:

security

Multiple flaws in telecoms stack software FreeSwitch uncovered \| The Daily Swig Related entries in the VARIoT vulnerabilities database: VAR-202110-1542, VAR-202110-1048, VAR-202110-1371, VAR-202110-1256 Trust: 4.5 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Nov. 1, 2021, 4:42 p.m.	Vulnerabilities: denial of service, information leakage

Affected products

External IDs

vendor:

freeswitch

model:

freeswitch

db:

NVD

ids:

CVE-2021-41145, CVE-2021-37624, CVE-2021-41158, CVE-2021-41105

Malicious Actor Discloses FortiGate SSL-VPN Credentials Related entries in the VARIoT vulnerabilities database: VAR-201906-0815 Trust: 3.75 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 8, 2021, 7 a.m.	Vulnerabilities: -

Affected products

External IDs

vendor:

fortigate

model:

fortios

db:

NVD

ids:

CVE-2018-13379

NSO Pegasus iPhone Spyware Vulnerabilities Fixed by Apple - Detect & Prioritize Using VMDR for Mobile Devices \| Qualys Security Blog Related entries in the VARIoT vulnerabilities database: VAR-202110-1684, VAR-202108-1057, VAR-202108-1374, VAR-202108-2172, VAR-202110-1685 Trust: 5.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 29, 2021, 8:28 a.m.	Vulnerabilities: privilege escalation, code execution

Affected products

External IDs

vendor:	google	model:	android
vendor:	apple	model:	webkit
vendor:	apple	model:	iphone
vendor:	apple	model:	ipad air
vendor:	apple	model:	ipad
vendor:	apple	model:	ipod touch

db:

NVD

ids:

CVE-2021-30847, CVE-2021-30860, CVE-2021-30869, CVE-2021-30858, CVE-2021-30835

Cisco Firepower Threat Defense Software CLI Arbitrary File Write (cisco-sa-ftd-file-write-SHVcmQVc) \| Tenable® Trust: 3.0 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Nov. 3, 2021, midnight	Vulnerabilities: -

Affected products

External IDs

vendor:	cisco	model:	cisco firepower threat defense software
vendor:	cisco	model:	firepower threat defense
vendor:	cisco	model:	firepower
vendor:	cisco	model:	firepower threat defense software

Researchers Develop Toolkit to Test Apple Security, Find Vulnerability \| NC State News Trust: 4.0 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 13, 2021, 8:34 a.m.	Vulnerabilities: timing attack

Affected products

External IDs

vendor:

apple

model:

iphone

The real dangers of vulnerable IoT devices - Infosec Resources Trust: 3.0 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 14, 2021, 10:41 p.m.	Vulnerabilities: -

Affected products

External IDs

db:

NVD

ids:

CVE-2021-31251

Hundreds of thousands of Realtek-based devices under attack from IoT botnet - The Record by Recorded Future Trust: 4.75 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Aug. 23, 2021, 6:56 p.m.	Vulnerabilities: -

Affected products

External IDs

vendor:	realtek	model:	realtek sdk
vendor:	mesh	model:	mesh

db:

NVD

ids:

CVE-2021-35395

Attackers Started Exploiting a Router Vulnerability Just 2 Days After Its Disclosure \| PCMag Related entries in the VARIoT vulnerabilities database: VAR-202104-0768 Trust: 4.75 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Jan. 11, 2022, midnight	Vulnerabilities: denial of service

Affected products

External IDs

vendor:	cisco	model:	cisco hyperflex
vendor:	cisco	model:	routers
vendor:	cisco	model:	hyperflex
vendor:	cisco	model:	soho
vendor:	cisco	model:	router
vendor:	d-link	model:	router
vendor:	tenda	model:	ac11
vendor:	tenda	model:	router

db:

NVD

ids:

CVE-2021-20090

BrakTooth Bluetooth vulnerabilities, crash all the devices! \| Malwarebytes Labs Trust: 4.0 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 2, 2021, 4:24 p.m.	Vulnerabilities: code execution

Affected products

External IDs

db:

NVD

ids:

CVE-2021-28139

Hikvision Has "Highest Level of Critical Vulnerability," Impacting 100+ Million Devices Trust: 5.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Sept. 20, 2021, 12:04 p.m.	Vulnerabilities: default password, denial of service, code execution...

Affected products

External IDs

vendor:	dahua	model:	camera
vendor:	dahua	model:	ip camera
vendor:	cisco	model:	routers
vendor:	cisco	model:	router
vendor:	cisco	model:	series
vendor:	huawei	model:	huawei
vendor:	huawei	model:	mate
vendor:	axis	model:	axis
vendor:	axis	model:	ip cameras
vendor:	hikvision	model:	camera
vendor:	hikvision	model:	hikvision
vendor:	hikvision	model:	ip cameras
vendor:	avigilon	model:	multiple
vendor:	phillips	model:	hue

db:

NVD

ids:

CVE-2021-36260

NVD - Home Trust: 3.25 Fetched: Nov. 4, 2021, 1:02 p.m., Published: Jan. 11, 2022, midnight	Vulnerabilities: -

Affected products

External IDs

db:

NVD

ids:

CVE-2021-42560

VARIoT news about IoT security