Arduino
Monthly
Command injection in Arduino App Lab prior to version 0.4.0 allows an attacker with physical access to a connected device to execute arbitrary shell commands by injecting metacharacters into unsanitized Serial and Address metadata fields during terminal session initialization. The vulnerability stems from insufficient input validation when processing hardware device information, enabling code execution with the privileges of the application.
The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photosensitivity. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Command injection in Arduino App Lab prior to version 0.4.0 allows an attacker with physical access to a connected device to execute arbitrary shell commands by injecting metacharacters into unsanitized Serial and Address metadata fields during terminal session initialization. The vulnerability stems from insufficient input validation when processing hardware device information, enabling code execution with the privileges of the application.
The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Arduino Create Agent is a package to help manage Arduino development. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photosensitivity. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.