Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
owser/youtube-video-player/trunk/front_end/scripts/youtube_embed_front_end.js - https://plugins.trac.wordpress.org/browser/auto-thickbox/trunk/js/auto-thickbox.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3281159%40nextgen-gallery&old=3276142%40nextgen-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2538 State: PUBLISHED Published: 2025-03-20T20:50:02.928Z Last Updated: 2025-10-01T03:55:59.384Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-798 Description: A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-1-patch/
CVE ID: CVE-2025-2539 State: PUBLISHED Published: 2025-03-20T11:11:26.994Z Last Updated: 2025-03-20T13:18:27.519Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: thomstark Products: File Away Problem Types: CWE-327 Description: The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
rary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b23bd5c-db27-4d63-8461-1f36958a2ff6?source=cve - https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_stats.php - https://plugins.trac.wordpress.org/browser/file-away/trunk/lib/cls/class.fileaway_encrypted.php - https://wordpress.org/plugins/file-away/#developers
CVE ID: CVE-2025-2540 State: PUBLISHED Published: 2025-07-03T11:19:50.243Z Last Updated: 2025-07-03T13:17:07.596Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nayon46, raihancse, devrix, fuzzoid, wptipsntricks Products: Awesome Wp Image Gallery, Awesome Gallery, Easy Image Gallery, Easy 3D Viewer, WP Video Lightbox Problem Types: CWE-79 Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu
ation and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82892be3-91d5-4350-96b0-dc68a67b4637?source=cve - https://plugins.trac.wordpress.org/browser/wp-video-lightbox/trunk/js/jquery.prettyPhoto.js - https://plugins.trac.wordpress.org/browser/woo-3d-viewer/trunk/includes/ext/prettyPhoto/js/jquery.prettyPhoto.init.min.js - https://plugins.trac.wordpress.org/browser/easy-image-galle
includes/ext/prettyPhoto/js/jquery.prettyPhoto.init.min.js - https://plugins.trac.wordpress.org/browser/easy-image-gallery/trunk/includes/lib/prettyphoto/jquery.prettyPhoto.js - https://plugins.trac.wordpress.org/browser/awesome-gallery/trunk/js/jquery.prettyPhoto.js - https://plugins.trac.wordpress.org/browser/awesome-wp-image-gallery/trunk/js/jquery.prettyPhoto.js - https://plugins.trac.wordpress.org/changeset/3266651/wp-video-lightbox - https://plugins.trac.wordpress.org/changeset/3282390/woo-3d-viewer
CVE ID: CVE-2025-2541 State: PUBLISHED Published: 2025-04-11T11:11:56.437Z Last Updated: 2025-04-11T13:23:10.793Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wedevs Products: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Problem Types: CWE-79 Description: The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that
possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7?source=cve - https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.20/core/WP/Frontend.php#L209 - https://wordpress.org/plugins/wedevs-project-manager/#developers - https://plugins.trac.wordpress.org/changeset/3268509/
CVE ID: CVE-2025-2542 State: PUBLISHED Published: 2025-03-25T09:22:02.466Z Last Updated: 2025-03-31T16:29:10.461Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: obbdpu Products: Your Simple SVG Support Problem Types: CWE-79 Description: The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Note
o inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa9d836-4e13-4c6a-b1e6-a8f984805842?source=cve - https://plugins.trac.wordpress.org/browser/your-simple-svg-support/tags/1.0.0/your-simple-svg-support.php#L16 - https://plugins.trac.wordpress.org/browser/your-simple-svg-support/tags/1.0.0/your-simple-svg-support.php#L20 - https://wordpress.org/plugins/your-simple-svg-support/#developers - https://plugins.trac.wordpress.org/changeset/3259951/
CVE ID: CVE-2025-2543 State: PUBLISHED Published: 2025-04-24T08:23:48.921Z Last Updated: 2025-04-24T13:57:31.585Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spiderdevs Products: Advanced Accordion Gutenberg Block Problem Types: CWE-79 Description: The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG fil
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79752ac3-cb5f-4d86-be58-c4b892e4edd6?source=cve - https://plugins.trac.wordpress.org/browser/advanced-accordion-block/tags/4.8.2/advanced-accordion-block.php#L363 - https://plugins.trac.wordpress.org/browser/advanced-accordion-block/tags/4.8.2/advanced-accordion-block.php#L364 - https://plugins.trac.wordpress.org/browser/advanced-accordion-block/tags/4.8.2/advanced-accordion-block.php#L369 - https://wordpress.org/plugins/advanced-accordion-block/#dev
cordion-block/tags/4.8.2/advanced-accordion-block.php#L369 - https://wordpress.org/plugins/advanced-accordion-block/#developers
CVE ID: CVE-2025-2544 State: PUBLISHED Published: 2025-04-05T01:44:45.428Z Last Updated: 2025-04-07T14:12:16.849Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: adamwillhoeft Products: AI Content Pipelines: Content Engine + Analytics Problem Types: CWE-79 Description: The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG fi
r-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b93214ec-5738-4f10-b48c-1d74aad52acb?source=cve - https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L42 - https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L44 - https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L47 - https://wordpress.org/plugins/ai-content-pipel
-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L47 - https://wordpress.org/plugins/ai-content-pipelines/#developers
CVE ID: CVE-2025-2545 State: PUBLISHED Published: 2025-05-05T11:28:43.668Z Last Updated: 2025-11-03T19:45:04.026Z Vendors: Best Practical Solutions Products: Request Tracker Problem Types: CWE-327 Description: Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cryptographic-algorithm-not-recommended-request-tracker-best-practical
CVE ID: CVE-2025-2546 State: PUBLISHED Published: 2025-03-20T15:00:20.920Z Last Updated: 2025-03-20T17:32:35.469Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formAdvFirewall of the component Firewall Service. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that
cal network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300160 - https://vuldb.com/?ctiid.300160 - https://vuldb.com/?submit.516788 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formAdvFirewall-1b053a41781f801ca1a5e09bb83a22c5?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formAdvFirewall-1b153a41781f80aca28ec11da787f0e8?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2547 State: PUBLISHED Published: 2025-03-20T15:31:14.499Z Last Updated: 2025-03-20T17:55:27.215Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of the file /goform/formAdvNetwork. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer suppor
oit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300161 - https://vuldb.com/?ctiid.300161 - https://vuldb.com/?submit.516789 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formAdvNetwork-1b053a41781f8085a4e8d3c1d1de5f56?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formAdvNetwork-1b153a41781f80109325dbc96ffc0295?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2548 State: PUBLISHED Published: 2025-03-20T15:31:26.534Z Last Updated: 2025-03-20T17:54:25.586Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/formSetDomainFilter. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by
s been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300162 - https://vuldb.com/?ctiid.300162 - https://vuldb.com/?submit.516790 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetDomainFilter-1b053a41781f80ffa989c54c391636f6?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetDomainFilter-1b153a41781f80498fcdf9d675df9b39?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2549 State: PUBLISHED Published: 2025-03-20T16:31:05.861Z Last Updated: 2025-03-20T17:52:41.485Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/formSetPassword. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no long
The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300163 - https://vuldb.com/?ctiid.300163 - https://vuldb.com/?submit.516791 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetPassword-1b053a41781f8021b704f7dfeb1fcd09?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetPassword-1b153a41781f803d8166f9b551b30cd4?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2550 State: PUBLISHED Published: 2025-03-20T16:31:08.092Z Last Updated: 2025-03-20T17:51:35.140Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/formSetDDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects produ
n the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300164 - https://vuldb.com/?ctiid.300164 - https://vuldb.com/?submit.516792 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetDDNS-1b053a41781f80659702da9a589e4f4a?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetDDNS-1b153a41781f80feb80bd24afc8f83d5?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2551 State: PUBLISHED Published: 2025-03-20T17:00:09.378Z Last Updated: 2025-03-20T17:44:53.818Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/formSetPortTr. The manipulation leads to improper access controls. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maint
closed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300165 - https://vuldb.com/?ctiid.300165 - https://vuldb.com/?submit.516793 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetPortTr-1b053a41781f8000a9ded17aa2f587cc?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetPortTr-1b153a41781f809d95c8e39c6c31c348?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2552 State: PUBLISHED Published: 2025-03-20T17:00:21.588Z Last Updated: 2025-03-20T17:38:59.028Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/formTcpipSetup. The manipulation leads to improper access controls. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer s
exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300166 - https://vuldb.com/?ctiid.300166 - https://vuldb.com/?submit.516794 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formTcpipSetup-1b053a41781f80fbbf94fda0c3b5ebfa?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formTcpipSetup-1b153a41781f80a7967ae08c81147a39?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2553 State: PUBLISHED Published: 2025-03-20T17:31:14.449Z Last Updated: 2025-03-20T17:44:27.251Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-618, DIR-605L Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supporte
t has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300167 - https://vuldb.com/?ctiid.300167 - https://vuldb.com/?submit.516795 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formVirtualServ-1b053a41781f80b28443daabf03c0825?pvs=4 - https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formVirtualServ-1b153a41781f80b98645c3f7f4c5f4ae?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2025-2555 State: PUBLISHED Published: 2025-03-20T18:00:07.109Z Last Updated: 2025-03-20T19:48:31.943Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Audi Products: Universal Traffic Recorder App Problem Types: CWE-259, CWE-255 Description: A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Credentials. The manipulation leads to use of hard-coded password. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading
igh. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300168 - https://vuldb.com/?ctiid.300168 - https://vuldb.com/?submit.513391 - https://github.com/geo-chen/Audi/blob/main/README.md#finding-2-hardcoded-credentials-in-audi-universal-traffic-recorder-ap
tps://github.com/geo-chen/Audi/blob/main/README.md#finding-2-hardcoded-credentials-in-audi-universal-traffic-recorder-app
CVE ID: CVE-2025-2556 State: PUBLISHED Published: 2025-03-20T18:00:08.572Z Last Updated: 2025-03-20T19:46:09.193Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Audi Products: UTR Dashcam Problem Types: CWE-798, CWE-259 Description: A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video Stream Handler. The manipulation leads to hard-coded credentials. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to
ed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300169 - https://vuldb.com/?ctiid.300169 - https://vuldb.com/?submit.513392 - https://github.com/geo-chen/Audi/blob/main/README.md#finding-3-rtsp-and-ftp-wide-open
CVE ID: CVE-2025-2557 State: PUBLISHED Published: 2025-03-20T18:31:04.421Z Last Updated: 2025-03-20T19:18:16.513Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Audi Products: UTR Dashcam Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the component Command API. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upg