IoT
Monthly
Authenticated users of the Meari IoT Cloud Platform OpenAPI Service can retrieve the complete device shadow of any device on the platform simply by supplying that device's ID, because the service performs no ownership or authorization check on the request (CWE-862 Missing Authorization); CVSS 4.0 base score 7.1, assessed as CVSS 3.1 7.1 with high confidentiality impact and no integrity or availability impact. The attacker must hold valid credentials for the OpenAPI Service - the vector is PR:L, so any single legitimate device owner or registered developer account qualifies - and must know or be able to enumerate target device IDs; no user interaction or special configuration is required. Exposed data includes device credentials, owner details, network configuration, and telemetry, so a successful read can enable device takeover and account enumeration. Reporting comes from CISA ICS-CERT (ICSA-26-274-06); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the low-complexity, network-reachable nature of the flaw makes follow-on abuse plausible.
Command injection in the Ziroom ZHOME A0101 smart-home gateway running firmware 1.0.1.0 allows a remote, high-privilege authenticated attacker to execute arbitrary operating-system commands on the device by supplying shell metacharacters in the 'url' argument of the /api/ZRnetwork/ping diagnostic endpoint. Publicly available exploit code exists - the reporting researcher published a proof-of-concept write-up on GitHub - and the vendor was contacted early about the disclosure but never responded, so no vendor-released patch is available and no CISA KEV entry or EPSS score was provided in the source data. The published CVSS 4.0 score of 8.5 is driven upward by subsequent-system (SC:H/SI:H/SA:H) metrics that our independent assessment considers inflated for a single embedded gateway; the practical risk is bounded by the PR:H administrative authentication prerequisite in the vector and by the fact that consumer smart-home management interfaces such as this are normally reachable only from the LAN.
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. No CISA KEV entry confirms active exploitation, and EPSS data was not provided.
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
Information disclosure in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows an authenticated, low-privilege user (CVSS vector PR:L) to reach two user-information endpoints that expose sensitive device and account details. The leak is not reproducible in normal operation - it appears only in a non-default, misconfigured, or transient device state - and it is a confidentiality-only exposure in the independent assessment (C:H/I:N/A:N), even though CISA, scoring on behalf of the vendor, assigned a CVSS 4.0 base of 8.7 that also claims high integrity and availability impact. There is no public exploit identified at time of analysis (no CISA KEV listing, no POC reference in the advisory data), and the affected product is a niche RTMP/H5 IoT camera with limited deployment, which constrains real-world risk.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the device's HTTP management API to execute arbitrary shell commands on the device by passing crafted shell metacharacters in the login_pwd argument of the /api/ZRnetwork/firstSetup_wifi endpoint. The vendor CVSS 4.0 vector (8.5, AV:N/AC:L/AT:N/PR:H/UI:N, with High confidentiality, integrity and availability impact plus changed scope) indicates that per the scoring model high privileges are required, although the independent assessment notes that because this is a first-time-provisioning endpoint the real privilege barrier may be weaker in practice and should be verified. Publicly available exploit code exists (a GitHub proof-of-concept), exploitation requires no user interaction, and no vendor patch is available because Ziroom did not respond to the disclosure.
Remote command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) lets an attacker who can reach the /api/ZRnetwork/firstLogin HTTP endpoint inject shell metacharacters through the 'firstLogin' parameter and execute arbitrary operating-system commands with the privileges of the underlying service. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub and the issue was reported via VulDB), and the vendor was contacted early but never responded, so no vendor patch is available. Scored 8.5 (CVSS 4.0 base, E:P) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H by our analysis; exploitation requires the device to be network-reachable, typically on a LAN or an exposed management interface.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote attacker to corrupt memory and potentially achieve code execution on the device by supplying a manipulated 'opt' argument to the menu_nat_more.asp endpoint handled by the menu_nat_more_asp function. The flaw is remotely reachable with low attack complexity and no user interaction, but exploitation requires valid admin-level credentials (CVSS PR:H) plus network reachability of the Web Administration Service, which is normally confined to the LAN unless remote management is enabled. Publicly available exploit code exists - a Python PoC and a technical write-up are published on GitHub - but there is no confirmation of active exploitation (no CISA KEV listing), and only firmware 16.07 is confirmed affected.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
Hardcoded root SSH access in F&F Filipowski's mH-DEVELOPER smart home module allows anyone who obtains the matching private key to log in as root over the always-running SSH daemon and fully compromise the device. The key is baked into /root/.ssh/authorized_keys, cannot be deleted without remounting the filesystem, and survives a factory reset, so the exposure persists until firmware 3.0.30 is installed. Attack surface is adjacent/local rather than Internet-wide (CVSS 4.0 7.7, AV:A/AC:H) and the private key is not published in the available sources, which is the main practical barrier; no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 3.0.30.
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. Exploitation is not confirmed as active (no CISA KEV entry), and the vendor was contacted early but never responded, so no official patch has been identified.
Unauthenticated stack-based buffer overflow in Buffalo WSR-300HP routers and WEX-G300 Wi-Fi extenders allows network-adjacent attackers to crash devices via crafted HTTP requests, causing denial-of-service. Exploitation requires network access to the HTTP management interface, typically only reachable from the local network unless remote administration is exposed to the WAN. No public exploit code or confirmed active exploitation (CISA KEV) has been identified, and the issue is assessed as genuine but low-priority due to reachability constraints.
Authenticated command injection in BUFFALO WSR-300HP wireless routers and WEX-G300 range extenders lets a user who already holds administrative access to the device's web management interface execute arbitrary operating system commands by submitting a crafted HTTP request to a web form field. Successful exploitation yields full compromise of the device (confidentiality, integrity and availability all rated High), but the attack is gated behind valid admin credentials or an active admin session, which is the dominant risk-limiting factor, and the affected models are primarily Japanese consumer/SOHO devices. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor CVSS 4.0 score of 8.6 reflects impact severity once the prerequisite administrative access is met.
Stack buffer overflow in RIOT OS coap_well_known_core_default_handler allows unauthenticated remote attackers to overwrite critical stack data including return addresses through oversized CoAP option responses. Affected IoT devices running RIOT 2026.01 and earlier are vulnerable to denial of service or arbitrary code execution without any user interaction required. No patch is currently available for this vulnerability.
Azure IoT Explorer fails to properly restrict communication to intended endpoints, enabling unauthenticated attackers to intercept and disclose sensitive information over the network. The vulnerability requires no user interaction and can be exploited remotely with a CVSS score of 7.5. A patch is available for affected Azure IoT products.
Azure IoT Explorer fails to enforce authentication on a critical function, enabling unauthenticated network attackers to remotely access and exfiltrate sensitive information. This high-severity vulnerability (CVSS 7.5) affects Azure IoT deployments and requires immediate patching to prevent unauthorized disclosure of IoT configuration and operational data. A patch is available.
Sensitive data transmission over cleartext in Azure IoT Explorer enables network-based attackers to intercept and disclose confidential information without authentication. This vulnerability affects Azure IoT deployments and could expose device credentials, configuration details, or other sensitive metadata to passive network observers. A patch is available to remediate the cleartext transmission issue.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
EnOcean SmartServer IoT versions 4.60.009 and earlier are vulnerable to unauthenticated remote command injection through maliciously crafted LON IP-852 management messages, enabling attackers to execute arbitrary OS commands with high privileges on affected devices. This network-accessible vulnerability requires no user interaction and affects IoT deployments with no available patch currently available.
MajorDoMo's unauthenticated /objects/?op=set endpoint fails to sanitize property values, allowing remote attackers to inject stored XSS payloads that execute when administrators access the property editor, with public exploit code available. The vulnerability is compounded by session cookies lacking HttpOnly protection, enabling attackers to enumerate properties via the /api.php/data/ endpoint and hijack admin sessions through JavaScript exfiltration.
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure or crashes on IoT devices.
Synectix LAN 232 TRIO serial-to-ethernet adapter exposes its web management interface without authentication (CVSS 10.0), enabling unauthenticated control of serial devices.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.
Denial of service in F&F Filipowski mH-DEVELOPER smart home modules running versions prior to 3.0.30, where the Node.js-based fh-node service accepts JSON and URL-encoded bodies up to 250 MB through the Express bodyParser, allowing a LAN-adjacent attacker to exhaust device RAM and crash the process with out-of-memory conditions. The vendor's CVSS 4.0 vector rates this 5.9 (medium, AV:A/AC:L/AT:P/PR:L) and is availability-only with no confidentiality or integrity impact; successfully triggering the crash is probabilistic because it depends on the device's instantaneous memory usage, which the attacker does not fully control, hence the AT:P rating. Although the vector nominally requires privileges (PR:L), the accompanying assessment notes that sibling flaw CVE-2026-82930 allows all endpoints to be queried without authentication, so any LAN user can reach the vulnerable body-parsing path in practice. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; exploitation is bounded to adjacent-network reach rather than the internet. Vendor-released patch: 3.0.30.
The F&F Filipowski mH-DEVELOPER smart home module ships production firmware built on end-of-life Debian 8 and Node.js 17.0.1, both of which are past their support lifecycles and carry publicly documented, permanently unpatched vulnerabilities. Rather than containing one discrete exploitable flaw, the product is exposed because it bundles obsolete, unsupported third-party components (CWE-1104); an attacker who can reach and correctly trigger one of the known component CVEs in this firmware could achieve arbitrary code execution, data disclosure, or denial of service, and the network-reachable services require no authentication (CVSS vector signals PR:N). No public exploit identified at time of analysis, and no KEV listing, so this is best treated as a software-composition hygiene finding whose real-world risk is contingent on how exposed the device's services are; F&F addressed the issue in firmware 3.0.30.
Cleartext transmission of credentials, authentication tokens, and device commands in the mH-DEVELOPER smart home module (F&F Filipowski) exposes every web interface and API session to interception by anyone sharing the same local network segment. Every version prior to 3.0.30 is affected, and because no TLS is used, a passive sniffer or an attacker who establishes an interception position (for example via ARP spoofing or a rogue access point) can harvest passwords and session tokens and then hijack sessions to issue device commands. Exploitation requires only an adjacent-network position and no authentication on the module itself; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, but the confidentiality impact is high and the flaw is trivially exploitable wherever untrusted clients, guest Wi-Fi, or shared VLANs can reach the device. Vendor-released patch: version 3.0.30.
mH-DEVELOPER smart home modules running firmware before 3.0.30 start up without loading any firewall rules, leaving SSH, HTTP, WebSocket, and Node-RED listening on the LAN with no access control, so any client on the same network segment can reach every service unauthenticated (CVSS 4.0 5.3; CVSS 3.1 AV:A/AC:L/PR:N/UI:N, low confidentiality and integrity impact). Exploitation requires network adjacency - the module is not reachable from the internet unless another device bridges access - and meaningful device takeover typically depends on chaining one of the sibling vulnerabilities covered by the same CERT-PL advisory. No public exploit identified at time of analysis, and the issue is a design/hygiene weakness (CWE-923) rather than a memory-corruption or code-execution flaw; the vendor fixed it in version 3.0.30.
Missing authentication in the mH-DEVELOPER smart home module lets any device on the same LAN query its HTTP API and WebSocket endpoints and issue raw control commands to building-automation hardware, because the authorization middleware never verifies tokens. The flaw maps to CWE-306 (Missing Authentication for Critical Function) and affects every release prior to 3.0.30, the version in which the vendor fixed it; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, base 6.4) and our independent CVSS 3.1 assessment agree that exploitation is trivial but gated by network adjacency: the attacker must already be on the same local or building network, and no authentication or user interaction is required beyond that.
Man-in-the-middle attacks against F&F Filipowski mH-DEVELOPER smart home modules running firmware before 3.0.30 are possible because every unit ships with the same hard-coded SSH host keys and performs no per-device key generation, so an attacker who extracts those keys from a firmware image can stand up a rogue SSH server that clients accept without any warning. Exploitation is unauthenticated (PR:N) but requires two prerequisites in combination: possession of the static keys and an on-path position between an SSH client and the device (reflected in the CVSS 4.0 AT:P requirement, and in our assessed CVSS:3.1 AC:H), which keeps this a moderate, on-path-dependent flaw rather than a mass-exploitable one; no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is limited to credential and data interception (VC:L/VI:L) with no availability effect, and devices updated to 3.0.30 are not vulnerable.
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attackers to abuse the TCP Service's PUT_FILE operation - manipulating its path argument - to read and write arbitrary files, including /tmp/wpa_supplicant.conf. Because no authentication, user interaction, or special configuration is required once the service is reachable (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, and the independent assessment's CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), the practical barrier is exposure: an attacker must have a network path to the dashcam's TCP service, typically via its own Wi-Fi hotspot or a LAN it is bridged to, which limits internet-wide exploitation. Publicly available exploit code exists (published in the Turretsec disclosure), and the vendor was contacted but did not respond, so no fix is available; there is no CISA KEV listing, so active exploitation is not confirmed.
Stack-based buffer overflow in PX4 autopilot versions 1.17.0-rc2 and below allows attackers with MAVLink link access to crash the flight controller by exploiting an unconstrained sscanf operation in the MavlinkLogHandler. An attacker can trigger this by creating deeply nested directories via MAVLink FTP and then requesting the log list, causing the MAVLink task to crash and resulting in loss of telemetry and command capability. This denial of service affects drone and unmanned vehicle systems relying on vulnerable PX4 versions.
The WiFi Extender WDR201A (hardware version 2.1, firmware LFMZX28040922V1.02) contains an unprotected UART interface exposed through accessible PCB pads, allowing information disclosure through direct hardware access. An attacker with physical access to the device can connect to the UART pins to read sensitive data, firmware contents, or configuration information without authentication. No CVSS score, EPSS metric, or KEV status is currently available, but a proof-of-concept and detailed security research have been published, confirming the vulnerability's practical exploitability.
Hardcoded credentials extractable through API responses and mobile app reverse engineering in an enterprise application. Administrative credentials are exposed in multiple channels.
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory. [CVSS 3.7 LOW]
Azure IoT Explorer binds to unrestricted IP addresses, enabling unauthenticated remote attackers to intercept and disclose sensitive information over the network. This vulnerability affects Azure IoT deployments where the Explorer tool is exposed without proper network segmentation. No patch is currently available, making network isolation the primary mitigation strategy.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]
Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.
Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the industrial monitoring database.
An API authentication bypass allows unauthenticated attackers to impersonate legitimate users. Maximum CVSS 10.0 with scope change. Requires knowledge of a legitimate user's identity.
Command injection via the hostname field allowing authenticated code execution with maximum CVSS 10.0 and scope change.
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
Unauthenticated OS command injection in the WODESYS WD-R608U small-office/home-office router (sold as WDR122B V2.0 and WDR28) allows an attacker positioned on the same LAN or Wi-Fi segment to execute arbitrary system shell commands through the langGet parameter of the adm.cgi web management endpoint. No credentials or user interaction are required - the injected input is passed to a system shell without validation - but exploitation is gated by adjacent-network positioning and by the admin interface being reachable, so the exposure is not internet-scale unless management access has been deliberately published. Only firmware WDR28081123OV1.01 was tested and confirmed vulnerable; the vendor did not respond with a vulnerability or version-range statement, so additional versions may also be affected. No vendor-released patch has been identified, and no public exploit code was identified at the time of analysis; EPSS is 2.70% (85th percentile), reflecting elevated but not top-tier exploitation likelihood.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Malformed JSON delivered to Aqara Hub M2 (4.3.6_0027), Hub M3 (4.3.6_0025), and Camera Hub G3 (4.1.9_0027) firmware crashes the JSON-processing routine through a NULL-pointer dereference, causing a denial of service on the affected hub. The vulnerability is only reachable by an attacker positioned on the same adjacent/local network as the device (AV:A, PR:N, UI:N), so it is not exploitable directly from the internet, and impact is limited to availability - no confidentiality or integrity loss is assessed. Publicly available exploit code exists (a GitHub write-up demonstrating the malformed-JSON trigger), but there is no CISA KEV confirmation of active exploitation, and EPSS is low at 0.28% (19th percentile), reflecting the adjacent-network prerequisite; overall this is a genuine but low-priority issue.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stems from an undocumented remote access mechanism that lets network-reachable attackers run arbitrary commands without authentication or user interaction. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though no CISA KEV record is provided confirming active exploitation. EPSS is 0.98% (61st percentile), indicating lower modeled near-term exploitation probability despite the severe impact if reachable.
Arbitrary command execution with root privileges is possible on Aqara Camera Hub G3 devices running firmware 4.1.9_0027 when the hub scans a maliciously crafted QR code during initial device setup or a factory reset. Because the attack vector is physical (CVSS AV:P) and requires a user or operator to perform the scan action (UI:R), exploitation is limited to those provisioning windows and is not possible against an already-configured hub in normal operation; the CVSS 3.1 base score is 6.6. Publicly available exploit code exists (a detailed PoC write-up is published), but the vulnerability is not confirmed as actively exploited (not in CISA KEV), and EPSS is low at 1.11% (64th percentile).
Command injection in Aqara hub firmware - Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 - lets an attacker who can get the device to process an attacker-controlled domain name/hostname execute arbitrary commands with root privileges. Delivery is gated: the CVSS vector (AV:L/AC:L/PR:L/UI:R) indicates local-network-adjacent access, low-privileged credentials (e.g. a paired companion-app session), and a user-triggered action are required; our own assessment raises the access vector to AV:A (adjacent network) because 'malicious domain names' implies DNS/network-borne delivery rather than physical console access. Publicly available exploit code exists (a detailed GitHub write-up), but the flaw is not in CISA KEV and EPSS is modest at 0.80% (55th percentile), so exploitation in the wild is not confirmed; only the exact firmware builds listed are confirmed affected.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).
Hardcoded Wi-Fi credentials embedded in Meatmeet Pro WiFi & Bluetooth meat thermometer firmware version 1.0.34.4 (CWE-798) can be recovered by anyone who obtains and reverse-engineers the firmware image, after which an attacker could join the vendor's internal test network if they also independently locate that physical network, or-if they are within close physical proximity during the device's first setup-stand up a rogue access point using the recovered SSID and password so the thermometer auto-connects to attacker-controlled infrastructure. The device is not exploitable over the public internet: our assessment rates the flaw CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (~4.2 Medium), so the published 9.8 CRITICAL score is grossly overstated relative to the described attack paths. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.43% (35th percentile), indicating low practical exploitation likelihood.
CVE-2025-7503 is a security vulnerability (CVSS 10.0). Critical severity with potential for significant impact on affected systems.
CVE-2025-1727 is a critical vulnerability in RF-based remote linking protocols used for End-of-Train (EoT) and Head-of-Train (HoT/FRED) devices in railway operations. The vulnerability exploits a weak BCH checksum implementation that allows attackers to forge brake control commands using software-defined radios (SDR), potentially disrupting train operations or overwhelming brake systems. This affects railway infrastructure globally, with a CVSS score of 8.1 indicating high severity; active exploitation status and proof-of-concept availability are critical factors that determine immediate priority despite the attack requiring physical/adjacent network proximity.
CVE-2025-48890 is a critical OS command injection vulnerability in the miniigd SOAP service affecting WRH-733GBK and WRH-733GWH network storage devices. Remote unauthenticated attackers can execute arbitrary OS commands by sending specially crafted requests, achieving complete system compromise (CVSS 9.8). With an attack vector of Network/Low complexity/No privileges required, this vulnerability poses immediate risk to exposed devices.
CVE-2025-48466 is a security vulnerability (CVSS 8.1). Risk factors: public PoC available.
A remote code execution vulnerability in versions from 2.5.0 to (CVSS 8.3). High severity vulnerability requiring prompt remediation. Vendor patch is available.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 8.8). Risk factors: public PoC available.
Critical remote code execution vulnerability in WOLFBOX Level 2 EV Charger devices that exploits an exposed dangerous method in the Tuya communications module, allowing network-adjacent attackers to upload and execute arbitrary code despite authentication requirements. The authentication bypass mechanism combined with the exposed software upload functionality creates a high-severity attack path that can grant attackers complete control over affected EV charger installations. This vulnerability (formerly ZDI-CAN-26349) presents significant risk to vehicle charging infrastructure and connected IoT deployments relying on Tuya-based communication protocols.
A remote code execution vulnerability in IDF (CVSS 8.3). High severity vulnerability requiring prompt remediation.
CVE-2018-25112 is an unauthenticated network-based Denial-of-Service vulnerability affecting IEC 61131-compliant Industrial Logic Controllers (ILCs). An attacker can exhaust device resources by flooding the controller with crafted network traffic, rendering it unresponsive. With a CVSS score of 7.5 (High severity), no authentication required, and network-accessible attack surface, this poses significant risk to industrial control systems; however, exploitation likelihood depends on network exposure and whether patches are available from affected vendors.
Authenticated users of the Meari IoT Cloud Platform OpenAPI Service can retrieve the complete device shadow of any device on the platform simply by supplying that device's ID, because the service performs no ownership or authorization check on the request (CWE-862 Missing Authorization); CVSS 4.0 base score 7.1, assessed as CVSS 3.1 7.1 with high confidentiality impact and no integrity or availability impact. The attacker must hold valid credentials for the OpenAPI Service - the vector is PR:L, so any single legitimate device owner or registered developer account qualifies - and must know or be able to enumerate target device IDs; no user interaction or special configuration is required. Exposed data includes device credentials, owner details, network configuration, and telemetry, so a successful read can enable device takeover and account enumeration. Reporting comes from CISA ICS-CERT (ICSA-26-274-06); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the low-complexity, network-reachable nature of the flaw makes follow-on abuse plausible.
Command injection in the Ziroom ZHOME A0101 smart-home gateway running firmware 1.0.1.0 allows a remote, high-privilege authenticated attacker to execute arbitrary operating-system commands on the device by supplying shell metacharacters in the 'url' argument of the /api/ZRnetwork/ping diagnostic endpoint. Publicly available exploit code exists - the reporting researcher published a proof-of-concept write-up on GitHub - and the vendor was contacted early about the disclosure but never responded, so no vendor-released patch is available and no CISA KEV entry or EPSS score was provided in the source data. The published CVSS 4.0 score of 8.5 is driven upward by subsequent-system (SC:H/SI:H/SA:H) metrics that our independent assessment considers inflated for a single embedded gateway; the practical risk is bounded by the PR:H administrative authentication prerequisite in the vector and by the fact that consumer smart-home management interfaces such as this are normally reachable only from the LAN.
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. No CISA KEV entry confirms active exploitation, and EPSS data was not provided.
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
Information disclosure in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows an authenticated, low-privilege user (CVSS vector PR:L) to reach two user-information endpoints that expose sensitive device and account details. The leak is not reproducible in normal operation - it appears only in a non-default, misconfigured, or transient device state - and it is a confidentiality-only exposure in the independent assessment (C:H/I:N/A:N), even though CISA, scoring on behalf of the vendor, assigned a CVSS 4.0 base of 8.7 that also claims high integrity and availability impact. There is no public exploit identified at time of analysis (no CISA KEV listing, no POC reference in the advisory data), and the affected product is a niche RTMP/H5 IoT camera with limited deployment, which constrains real-world risk.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the device's HTTP management API to execute arbitrary shell commands on the device by passing crafted shell metacharacters in the login_pwd argument of the /api/ZRnetwork/firstSetup_wifi endpoint. The vendor CVSS 4.0 vector (8.5, AV:N/AC:L/AT:N/PR:H/UI:N, with High confidentiality, integrity and availability impact plus changed scope) indicates that per the scoring model high privileges are required, although the independent assessment notes that because this is a first-time-provisioning endpoint the real privilege barrier may be weaker in practice and should be verified. Publicly available exploit code exists (a GitHub proof-of-concept), exploitation requires no user interaction, and no vendor patch is available because Ziroom did not respond to the disclosure.
Remote command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) lets an attacker who can reach the /api/ZRnetwork/firstLogin HTTP endpoint inject shell metacharacters through the 'firstLogin' parameter and execute arbitrary operating-system commands with the privileges of the underlying service. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub and the issue was reported via VulDB), and the vendor was contacted early but never responded, so no vendor patch is available. Scored 8.5 (CVSS 4.0 base, E:P) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H by our analysis; exploitation requires the device to be network-reachable, typically on a LAN or an exposed management interface.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote attacker to corrupt memory and potentially achieve code execution on the device by supplying a manipulated 'opt' argument to the menu_nat_more.asp endpoint handled by the menu_nat_more_asp function. The flaw is remotely reachable with low attack complexity and no user interaction, but exploitation requires valid admin-level credentials (CVSS PR:H) plus network reachability of the Web Administration Service, which is normally confined to the LAN unless remote management is enabled. Publicly available exploit code exists - a Python PoC and a technical write-up are published on GitHub - but there is no confirmation of active exploitation (no CISA KEV listing), and only firmware 16.07 is confirmed affected.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
Hardcoded root SSH access in F&F Filipowski's mH-DEVELOPER smart home module allows anyone who obtains the matching private key to log in as root over the always-running SSH daemon and fully compromise the device. The key is baked into /root/.ssh/authorized_keys, cannot be deleted without remounting the filesystem, and survives a factory reset, so the exposure persists until firmware 3.0.30 is installed. Attack surface is adjacent/local rather than Internet-wide (CVSS 4.0 7.7, AV:A/AC:H) and the private key is not published in the available sources, which is the main practical barrier; no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 3.0.30.
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. Exploitation is not confirmed as active (no CISA KEV entry), and the vendor was contacted early but never responded, so no official patch has been identified.
Unauthenticated stack-based buffer overflow in Buffalo WSR-300HP routers and WEX-G300 Wi-Fi extenders allows network-adjacent attackers to crash devices via crafted HTTP requests, causing denial-of-service. Exploitation requires network access to the HTTP management interface, typically only reachable from the local network unless remote administration is exposed to the WAN. No public exploit code or confirmed active exploitation (CISA KEV) has been identified, and the issue is assessed as genuine but low-priority due to reachability constraints.
Authenticated command injection in BUFFALO WSR-300HP wireless routers and WEX-G300 range extenders lets a user who already holds administrative access to the device's web management interface execute arbitrary operating system commands by submitting a crafted HTTP request to a web form field. Successful exploitation yields full compromise of the device (confidentiality, integrity and availability all rated High), but the attack is gated behind valid admin credentials or an active admin session, which is the dominant risk-limiting factor, and the affected models are primarily Japanese consumer/SOHO devices. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor CVSS 4.0 score of 8.6 reflects impact severity once the prerequisite administrative access is met.
Stack buffer overflow in RIOT OS coap_well_known_core_default_handler allows unauthenticated remote attackers to overwrite critical stack data including return addresses through oversized CoAP option responses. Affected IoT devices running RIOT 2026.01 and earlier are vulnerable to denial of service or arbitrary code execution without any user interaction required. No patch is currently available for this vulnerability.
Azure IoT Explorer fails to properly restrict communication to intended endpoints, enabling unauthenticated attackers to intercept and disclose sensitive information over the network. The vulnerability requires no user interaction and can be exploited remotely with a CVSS score of 7.5. A patch is available for affected Azure IoT products.
Azure IoT Explorer fails to enforce authentication on a critical function, enabling unauthenticated network attackers to remotely access and exfiltrate sensitive information. This high-severity vulnerability (CVSS 7.5) affects Azure IoT deployments and requires immediate patching to prevent unauthorized disclosure of IoT configuration and operational data. A patch is available.
Sensitive data transmission over cleartext in Azure IoT Explorer enables network-based attackers to intercept and disclose confidential information without authentication. This vulnerability affects Azure IoT deployments and could expose device credentials, configuration details, or other sensitive metadata to passive network observers. A patch is available to remediate the cleartext transmission issue.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
EnOcean SmartServer IoT versions 4.60.009 and earlier are vulnerable to unauthenticated remote command injection through maliciously crafted LON IP-852 management messages, enabling attackers to execute arbitrary OS commands with high privileges on affected devices. This network-accessible vulnerability requires no user interaction and affects IoT deployments with no available patch currently available.
MajorDoMo's unauthenticated /objects/?op=set endpoint fails to sanitize property values, allowing remote attackers to inject stored XSS payloads that execute when administrators access the property editor, with public exploit code available. The vulnerability is compounded by session cookies lacking HttpOnly protection, enabling attackers to enumerate properties via the /api.php/data/ endpoint and hijack admin sessions through JavaScript exfiltration.
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure or crashes on IoT devices.
Synectix LAN 232 TRIO serial-to-ethernet adapter exposes its web management interface without authentication (CVSS 10.0), enabling unauthenticated control of serial devices.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.
Denial of service in F&F Filipowski mH-DEVELOPER smart home modules running versions prior to 3.0.30, where the Node.js-based fh-node service accepts JSON and URL-encoded bodies up to 250 MB through the Express bodyParser, allowing a LAN-adjacent attacker to exhaust device RAM and crash the process with out-of-memory conditions. The vendor's CVSS 4.0 vector rates this 5.9 (medium, AV:A/AC:L/AT:P/PR:L) and is availability-only with no confidentiality or integrity impact; successfully triggering the crash is probabilistic because it depends on the device's instantaneous memory usage, which the attacker does not fully control, hence the AT:P rating. Although the vector nominally requires privileges (PR:L), the accompanying assessment notes that sibling flaw CVE-2026-82930 allows all endpoints to be queried without authentication, so any LAN user can reach the vulnerable body-parsing path in practice. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; exploitation is bounded to adjacent-network reach rather than the internet. Vendor-released patch: 3.0.30.
The F&F Filipowski mH-DEVELOPER smart home module ships production firmware built on end-of-life Debian 8 and Node.js 17.0.1, both of which are past their support lifecycles and carry publicly documented, permanently unpatched vulnerabilities. Rather than containing one discrete exploitable flaw, the product is exposed because it bundles obsolete, unsupported third-party components (CWE-1104); an attacker who can reach and correctly trigger one of the known component CVEs in this firmware could achieve arbitrary code execution, data disclosure, or denial of service, and the network-reachable services require no authentication (CVSS vector signals PR:N). No public exploit identified at time of analysis, and no KEV listing, so this is best treated as a software-composition hygiene finding whose real-world risk is contingent on how exposed the device's services are; F&F addressed the issue in firmware 3.0.30.
Cleartext transmission of credentials, authentication tokens, and device commands in the mH-DEVELOPER smart home module (F&F Filipowski) exposes every web interface and API session to interception by anyone sharing the same local network segment. Every version prior to 3.0.30 is affected, and because no TLS is used, a passive sniffer or an attacker who establishes an interception position (for example via ARP spoofing or a rogue access point) can harvest passwords and session tokens and then hijack sessions to issue device commands. Exploitation requires only an adjacent-network position and no authentication on the module itself; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, but the confidentiality impact is high and the flaw is trivially exploitable wherever untrusted clients, guest Wi-Fi, or shared VLANs can reach the device. Vendor-released patch: version 3.0.30.
mH-DEVELOPER smart home modules running firmware before 3.0.30 start up without loading any firewall rules, leaving SSH, HTTP, WebSocket, and Node-RED listening on the LAN with no access control, so any client on the same network segment can reach every service unauthenticated (CVSS 4.0 5.3; CVSS 3.1 AV:A/AC:L/PR:N/UI:N, low confidentiality and integrity impact). Exploitation requires network adjacency - the module is not reachable from the internet unless another device bridges access - and meaningful device takeover typically depends on chaining one of the sibling vulnerabilities covered by the same CERT-PL advisory. No public exploit identified at time of analysis, and the issue is a design/hygiene weakness (CWE-923) rather than a memory-corruption or code-execution flaw; the vendor fixed it in version 3.0.30.
Missing authentication in the mH-DEVELOPER smart home module lets any device on the same LAN query its HTTP API and WebSocket endpoints and issue raw control commands to building-automation hardware, because the authorization middleware never verifies tokens. The flaw maps to CWE-306 (Missing Authentication for Critical Function) and affects every release prior to 3.0.30, the version in which the vendor fixed it; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, base 6.4) and our independent CVSS 3.1 assessment agree that exploitation is trivial but gated by network adjacency: the attacker must already be on the same local or building network, and no authentication or user interaction is required beyond that.
Man-in-the-middle attacks against F&F Filipowski mH-DEVELOPER smart home modules running firmware before 3.0.30 are possible because every unit ships with the same hard-coded SSH host keys and performs no per-device key generation, so an attacker who extracts those keys from a firmware image can stand up a rogue SSH server that clients accept without any warning. Exploitation is unauthenticated (PR:N) but requires two prerequisites in combination: possession of the static keys and an on-path position between an SSH client and the device (reflected in the CVSS 4.0 AT:P requirement, and in our assessed CVSS:3.1 AC:H), which keeps this a moderate, on-path-dependent flaw rather than a mass-exploitable one; no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is limited to credential and data interception (VC:L/VI:L) with no availability effect, and devices updated to 3.0.30 are not vulnerable.
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attackers to abuse the TCP Service's PUT_FILE operation - manipulating its path argument - to read and write arbitrary files, including /tmp/wpa_supplicant.conf. Because no authentication, user interaction, or special configuration is required once the service is reachable (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, and the independent assessment's CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), the practical barrier is exposure: an attacker must have a network path to the dashcam's TCP service, typically via its own Wi-Fi hotspot or a LAN it is bridged to, which limits internet-wide exploitation. Publicly available exploit code exists (published in the Turretsec disclosure), and the vendor was contacted but did not respond, so no fix is available; there is no CISA KEV listing, so active exploitation is not confirmed.
Stack-based buffer overflow in PX4 autopilot versions 1.17.0-rc2 and below allows attackers with MAVLink link access to crash the flight controller by exploiting an unconstrained sscanf operation in the MavlinkLogHandler. An attacker can trigger this by creating deeply nested directories via MAVLink FTP and then requesting the log list, causing the MAVLink task to crash and resulting in loss of telemetry and command capability. This denial of service affects drone and unmanned vehicle systems relying on vulnerable PX4 versions.
The WiFi Extender WDR201A (hardware version 2.1, firmware LFMZX28040922V1.02) contains an unprotected UART interface exposed through accessible PCB pads, allowing information disclosure through direct hardware access. An attacker with physical access to the device can connect to the UART pins to read sensitive data, firmware contents, or configuration information without authentication. No CVSS score, EPSS metric, or KEV status is currently available, but a proof-of-concept and detailed security research have been published, confirming the vulnerability's practical exploitability.
Hardcoded credentials extractable through API responses and mobile app reverse engineering in an enterprise application. Administrative credentials are exposed in multiple channels.
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory. [CVSS 3.7 LOW]
Azure IoT Explorer binds to unrestricted IP addresses, enabling unauthenticated remote attackers to intercept and disclose sensitive information over the network. This vulnerability affects Azure IoT deployments where the Explorer tool is exposed without proper network segmentation. No patch is currently available, making network isolation the primary mitigation strategy.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]
Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.
Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the industrial monitoring database.
An API authentication bypass allows unauthenticated attackers to impersonate legitimate users. Maximum CVSS 10.0 with scope change. Requires knowledge of a legitimate user's identity.
Command injection via the hostname field allowing authenticated code execution with maximum CVSS 10.0 and scope change.
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
Unauthenticated OS command injection in the WODESYS WD-R608U small-office/home-office router (sold as WDR122B V2.0 and WDR28) allows an attacker positioned on the same LAN or Wi-Fi segment to execute arbitrary system shell commands through the langGet parameter of the adm.cgi web management endpoint. No credentials or user interaction are required - the injected input is passed to a system shell without validation - but exploitation is gated by adjacent-network positioning and by the admin interface being reachable, so the exposure is not internet-scale unless management access has been deliberately published. Only firmware WDR28081123OV1.01 was tested and confirmed vulnerable; the vendor did not respond with a vulnerability or version-range statement, so additional versions may also be affected. No vendor-released patch has been identified, and no public exploit code was identified at the time of analysis; EPSS is 2.70% (85th percentile), reflecting elevated but not top-tier exploitation likelihood.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Malformed JSON delivered to Aqara Hub M2 (4.3.6_0027), Hub M3 (4.3.6_0025), and Camera Hub G3 (4.1.9_0027) firmware crashes the JSON-processing routine through a NULL-pointer dereference, causing a denial of service on the affected hub. The vulnerability is only reachable by an attacker positioned on the same adjacent/local network as the device (AV:A, PR:N, UI:N), so it is not exploitable directly from the internet, and impact is limited to availability - no confidentiality or integrity loss is assessed. Publicly available exploit code exists (a GitHub write-up demonstrating the malformed-JSON trigger), but there is no CISA KEV confirmation of active exploitation, and EPSS is low at 0.28% (19th percentile), reflecting the adjacent-network prerequisite; overall this is a genuine but low-priority issue.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stems from an undocumented remote access mechanism that lets network-reachable attackers run arbitrary commands without authentication or user interaction. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though no CISA KEV record is provided confirming active exploitation. EPSS is 0.98% (61st percentile), indicating lower modeled near-term exploitation probability despite the severe impact if reachable.
Arbitrary command execution with root privileges is possible on Aqara Camera Hub G3 devices running firmware 4.1.9_0027 when the hub scans a maliciously crafted QR code during initial device setup or a factory reset. Because the attack vector is physical (CVSS AV:P) and requires a user or operator to perform the scan action (UI:R), exploitation is limited to those provisioning windows and is not possible against an already-configured hub in normal operation; the CVSS 3.1 base score is 6.6. Publicly available exploit code exists (a detailed PoC write-up is published), but the vulnerability is not confirmed as actively exploited (not in CISA KEV), and EPSS is low at 1.11% (64th percentile).
Command injection in Aqara hub firmware - Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 - lets an attacker who can get the device to process an attacker-controlled domain name/hostname execute arbitrary commands with root privileges. Delivery is gated: the CVSS vector (AV:L/AC:L/PR:L/UI:R) indicates local-network-adjacent access, low-privileged credentials (e.g. a paired companion-app session), and a user-triggered action are required; our own assessment raises the access vector to AV:A (adjacent network) because 'malicious domain names' implies DNS/network-borne delivery rather than physical console access. Publicly available exploit code exists (a detailed GitHub write-up), but the flaw is not in CISA KEV and EPSS is modest at 0.80% (55th percentile), so exploitation in the wild is not confirmed; only the exact firmware builds listed are confirmed affected.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).
Hardcoded Wi-Fi credentials embedded in Meatmeet Pro WiFi & Bluetooth meat thermometer firmware version 1.0.34.4 (CWE-798) can be recovered by anyone who obtains and reverse-engineers the firmware image, after which an attacker could join the vendor's internal test network if they also independently locate that physical network, or-if they are within close physical proximity during the device's first setup-stand up a rogue access point using the recovered SSID and password so the thermometer auto-connects to attacker-controlled infrastructure. The device is not exploitable over the public internet: our assessment rates the flaw CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (~4.2 Medium), so the published 9.8 CRITICAL score is grossly overstated relative to the described attack paths. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.43% (35th percentile), indicating low practical exploitation likelihood.
CVE-2025-7503 is a security vulnerability (CVSS 10.0). Critical severity with potential for significant impact on affected systems.
CVE-2025-1727 is a critical vulnerability in RF-based remote linking protocols used for End-of-Train (EoT) and Head-of-Train (HoT/FRED) devices in railway operations. The vulnerability exploits a weak BCH checksum implementation that allows attackers to forge brake control commands using software-defined radios (SDR), potentially disrupting train operations or overwhelming brake systems. This affects railway infrastructure globally, with a CVSS score of 8.1 indicating high severity; active exploitation status and proof-of-concept availability are critical factors that determine immediate priority despite the attack requiring physical/adjacent network proximity.
CVE-2025-48890 is a critical OS command injection vulnerability in the miniigd SOAP service affecting WRH-733GBK and WRH-733GWH network storage devices. Remote unauthenticated attackers can execute arbitrary OS commands by sending specially crafted requests, achieving complete system compromise (CVSS 9.8). With an attack vector of Network/Low complexity/No privileges required, this vulnerability poses immediate risk to exposed devices.
CVE-2025-48466 is a security vulnerability (CVSS 8.1). Risk factors: public PoC available.
A remote code execution vulnerability in versions from 2.5.0 to (CVSS 8.3). High severity vulnerability requiring prompt remediation. Vendor patch is available.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 8.8). Risk factors: public PoC available.
Critical remote code execution vulnerability in WOLFBOX Level 2 EV Charger devices that exploits an exposed dangerous method in the Tuya communications module, allowing network-adjacent attackers to upload and execute arbitrary code despite authentication requirements. The authentication bypass mechanism combined with the exposed software upload functionality creates a high-severity attack path that can grant attackers complete control over affected EV charger installations. This vulnerability (formerly ZDI-CAN-26349) presents significant risk to vehicle charging infrastructure and connected IoT deployments relying on Tuya-based communication protocols.
A remote code execution vulnerability in IDF (CVSS 8.3). High severity vulnerability requiring prompt remediation.
CVE-2018-25112 is an unauthenticated network-based Denial-of-Service vulnerability affecting IEC 61131-compliant Industrial Logic Controllers (ILCs). An attacker can exhaust device resources by flooding the controller with crafted network traffic, rendering it unresponsive. With a CVSS score of 7.5 (High severity), no authentication required, and network-accessible attack surface, this poses significant risk to industrial control systems; however, exploitation likelihood depends on network exposure and whether patches are available from affected vendors.