Csaf
by Cisagov
Source repositories
CVEs (129)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-58428 | Cri | 0.64 | 9.9 | 0.01 | Oct 23, 2025 | The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker… | ||
| CVE-2025-54807 | Cri | 0.64 | 9.8 | 0.01 | Sep 18, 2025 | The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system. | ||
| CVE-2026-66890 | Cri | 0.62 | 9.6 | 0.00 | Sep 15, 2026 | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. | ||
| CVE-2026-66887 | Cri | 0.62 | 9.6 | 0.00 | Sep 15, 2026 | The affected products are missing authorization on state-changing CGIs and session checks are not performed. | ||
| CVE-2026-40702 | Cri | 0.61 | 9.4 | 0.01 | Jun 25, 2026 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is… | ||
| CVE-2025-13607 | Cri | 0.61 | 9.4 | 0.01 | Dec 10, 2025 | A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL. | ||
| CVE-2026-5387 | Cri | 0.60 | — | 0.00 | Apr 15, 2026 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters,… | ||
| CVE-2026-5386 | Cri | 0.59 | 9.1 | 0.01 | May 29, 2026 | The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings. | ||
| CVE-2026-8598 | Cri | 0.59 | 9.1 | 0.01 | May 20, 2026 | An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials. | ||
| CVE-2026-6284 | Cri | 0.59 | 9.1 | 0.00 | Apr 17, 2026 | An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible. | ||
| CVE-2026-1632 | Cri | 0.59 | 9.1 | 0.00 | Feb 3, 2026 | MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device. | ||
| CVE-2026-68950 | Hig | 0.57 | 8.8 | 0.00 | Sep 15, 2026 | The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable. | ||
| CVE-2026-68070 | Hig | 0.57 | 8.8 | 0.00 | Sep 15, 2026 | The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command. | ||
| CVE-2026-81640 | Hig | 0.57 | 8.8 | 0.00 | Sep 9, 2026 | An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality. | ||
| CVE-2026-77966 | Hig | 0.57 | 8.8 | 0.00 | Aug 31, 2026 | The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity,… | ||
| CVE-2026-78037 | Hig | 0.57 | 8.8 | 0.01 | Aug 28, 2026 | Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive… | ||
| CVE-2026-42947 | Hig | 0.57 | 8.8 | 0.00 | Jun 12, 2026 | A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker… | ||
| CVE-2026-5768 | Hig | 0.57 | 8.8 | 0.00 | May 29, 2026 | The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping… | ||
| CVE-2026-4436 | Hig | 0.56 | 8.6 | 0.00 | Apr 9, 2026 | A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line. | ||
| CVE-2026-6824 | Hig | 0.55 | 8.4 | 0.00 | May 29, 2026 | A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend.… |
- risk 0.64cvss 9.9epss 0.01
The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker…
- risk 0.64cvss 9.8epss 0.01
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.
- risk 0.62cvss 9.6epss 0.00
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
- risk 0.62cvss 9.6epss 0.00
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
- risk 0.61cvss 9.4epss 0.01
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is…
- risk 0.61cvss 9.4epss 0.01
A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL.
- risk 0.60cvss —epss 0.00
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters,…
- risk 0.59cvss 9.1epss 0.01
The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings.
- risk 0.59cvss 9.1epss 0.01
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.
- risk 0.59cvss 9.1epss 0.00
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.
- risk 0.59cvss 9.1epss 0.00
MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device.
- risk 0.57cvss 8.8epss 0.00
The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.
- risk 0.57cvss 8.8epss 0.00
The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.
- risk 0.57cvss 8.8epss 0.00
An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.
- risk 0.57cvss 8.8epss 0.00
The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity,…
- risk 0.57cvss 8.8epss 0.01
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive…
- risk 0.57cvss 8.8epss 0.00
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker…
- risk 0.57cvss 8.8epss 0.00
The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping…
- risk 0.56cvss 8.6epss 0.00
A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.
- risk 0.55cvss 8.4epss 0.00
A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend.…
Page 2 of 7