Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5101 State: PUBLISHED Published: 2025-08-27T19:33:36.040Z Last Updated: 2025-08-27T19:53:36.682Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitl
tags during repository imports. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/545165 - https://hackerone.com/reports/3124199
CVE ID: CVE-2025-5103 State: PUBLISHED Published: 2025-06-03T08:21:54.213Z Last Updated: 2025-06-03T13:29:23.547Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: wpswings Products: Ultimate Gift Cards for WooCommerce Problem Types: CWE-89 Description: The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'product_id' parameters in all versions up to, and including, 3.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and ab
on on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e89383-a9c6-4300-970c-0b36e4d97e3d?source=cve - https://wordpress.org/plugins/woo-gift-cards-lite/#developers - https://plugins.trac.wordpress.org/browser/woo-gift-cards-lite/tags/3.1.4/admin/class-woocommerce-gift-cards-lite-admin.php#L571 - https://plugins.trac.wordpress.org/changeset/3303359/
CVE ID: CVE-2025-5104 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:40.371Z Description: No description available.
CVE ID: CVE-2025-5105 State: PUBLISHED Published: 2025-05-23T12:00:06.933Z Last Updated: 2025-05-23T13:16:21.832Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: TOZED Products: ZLT W51 Problem Types: CWE-244 Description: A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical. Affected by this issue is some unknown functionality of the component Service Port 7777. The manipulation leads to improper clearing of heap memory before release. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA A
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310082 - https://vuldb.com/?ctiid.310082 - https://vuldb.com/?submit.568495 - https://github.com/Zephkek/LeakyTozed - https://github.com/Zephkek/LeakyTozed#41-proof-of-concept
CVE ID: CVE-2025-5106 State: PUBLISHED Published: 2025-05-23T12:00:09.164Z Last Updated: 2025-05-23T13:09:55.208Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Fujian Products: Kelixun Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Fujian Kelixun 1.0. It has been classified as critical. This affects an unknown part of the file /app/fax/fax_view.php of the component Filename Handler. The manipulation of the argument fax_file leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additi
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310083 - https://vuldb.com/?ctiid.310083 - https://vuldb.com/?submit.569404 - https://github.com/byxs0x0/SQL/issues/2
CVE ID: CVE-2025-5107 State: PUBLISHED Published: 2025-05-23T12:31:04.393Z Last Updated: 2025-05-27T14:41:49.492Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fujian Products: Kelixun Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Fujian Kelixun 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /app/xml_cdr/xml_cdr_details.php. The manipulation of the argument uuid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vuln
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310084 - https://vuldb.com/?ctiid.310084 - https://vuldb.com/?submit.569448 - https://github.com/Qi-gy/cve/issues/1
CVE ID: CVE-2025-5108 State: PUBLISHED Published: 2025-05-23T12:31:05.584Z Last Updated: 2025-05-27T14:41:15.090Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zongzhige Products: ShopXO Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any
isclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310085 - https://vuldb.com/?ctiid.310085 - https://vuldb.com/?submit.569827 - https://github.com/147536951/Qiany1/blob/main/shopxo6.5.pdf
CVE ID: CVE-2025-5109 State: PUBLISHED Published: 2025-05-23T13:00:08.235Z Last Updated: 2025-05-23T13:19:39.982Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310086 - https://vuldb.com/?ctiid.310086 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310086 - https://vuldb.com/?ctiid.310086 - https://vuldb.com/?submit.581298 - https://fitoxs.com/exploit/exploit-0420d1a7d4e6b45cf1f0b87c2d580c4df77281242d0e9d1b77d7e2fd08f3a41d.txt
CVE ID: CVE-2025-5110 State: PUBLISHED Published: 2025-05-23T13:31:04.645Z Last Updated: 2025-05-23T13:43:25.002Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310087 - https://vuldb.com/?ctiid.310087
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310087 - https://vuldb.com/?ctiid.310087 - https://vuldb.com/?submit.582957 - https://fitoxs.com/exploit/exploit-325e5cf47259d3b511d301c84b53946fd1b78226df7291d441103ef5295f216e.txt
CVE ID: CVE-2025-5111 State: PUBLISHED Published: 2025-05-23T14:00:11.662Z Last Updated: 2025-05-23T14:35:56.607Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310088 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310088 - https://vuldb.com/?ctiid.310088 - https://vuldb.com/?submit.582958 - https://fitoxs.com/exploit/exploit-b08607fc683b518b37423881e5ee902fdb2a7c04ac57f7ff725df240e171f5e3.txt
CVE ID: CVE-2025-5112 State: PUBLISHED Published: 2025-05-23T14:00:12.986Z Last Updated: 2025-05-23T14:10:43.437Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310089 - https://vuldb.com/?ctiid.310089 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310089 - https://vuldb.com/?ctiid.310089 - https://vuldb.com/?submit.582962 - https://fitoxs.com/exploit/exploit-47929b46e253abc8390610b6ad91d5dc9f2d64a755e6fdb51d5f8f92e37947e2.txt
CVE ID: CVE-2025-5113 State: PUBLISHED Published: 2025-06-02T07:13:54.433Z Last Updated: 2025-06-02T13:32:28.052Z Vendors: Diviotec Products: nbr222p, nbr222pv, nbr224p, nbr225p, nbr226p, nbf232p, nbf233p, ndr252p, ndr255p Problem Types: CWE-77 Description: The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/security-advisory-remote-code-execution-on-diviotec-ip-camera-cve-2025-5113
CVE ID: CVE-2025-5114 State: PUBLISHED Published: 2025-05-23T14:31:04.924Z Last Updated: 2025-05-23T14:41:59.798Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: easysoft Products: zentaopms Problem Types: CWE-502, CWE-20 Description: A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early
can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310090 - https://vuldb.com/?ctiid.310090 - https://vuldb.com/?submit.570727 - https://github.com/3em0/cve_repo/blob/main/zentaopms/Phar%20Bypass%20Vulnerability%20in%20ZenTao.md - https://github.com/3em0/cve_repo/blob/main/zentaopms/Phar%20Bypass%20Vulnerability%20in%20ZenTao.md#exploitation
CVE ID: CVE-2025-5115 State: PUBLISHED Published: 2025-08-20T19:07:11.546Z Last Updated: 2025-11-04T21:11:37.182Z Vendors: Eclipse Jetty Products: Eclipse Jetty Problem Types: CWE-400 Description: In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.or
send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time. The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links: * https://github.com/jetty/jetty.projec
me for a closed stream) that cause the server to send a RST_STREAM frame. Links: * https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h - https://github.com/jetty/jetty.project/pull/13449 - https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.0 - https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.25 - https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.26 - https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.26 - https://github.com/jetty/jetty.project/relea
.0.26 - https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.26 - https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.58.v20250814
CVE ID: CVE-2025-5116 State: PUBLISHED Published: 2025-06-03T08:21:53.834Z Last Updated: 2025-06-03T13:29:52.353Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brikou Products: WP Plugin Info Card Problem Types: CWE-79 Description: The WP Plugin Info Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerid’ parameter in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue is due to an incomplete patch for CVE-2025-31835. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e29ea7dd-14b8-45d3-a87e-3f58de88af4c?source=cve - https://plugins.trac.wordpress.org/browser/wp-plugin-info-card/trunk/php/Shortcodes.php#L929 - https://wordpress.org/plugins/wp-plugin-info-card/#developers - https://plugins.trac.wordpress.org/changeset/3303791 - https://github.com/DLXPlugins/wp-plugin-info-card/blob/dev/php/Shortcodes.php#L893
CVE ID: CVE-2025-5117 State: PUBLISHED Published: 2025-05-27T11:14:26.964Z Last Updated: 2025-05-27T13:05:07.985Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeglow Products: Property – Real Estate Directory Listing Problem Types: CWE-862 Description: The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the property_package_user_role metadata in versions 1.0.5 to 1.0.6. This makes it possible for authenticated attackers, with Author‐level access and above, to elevate their privileges to that of an administrator by creating a package post whose property_package_user_role is set to adminis
eir privileges to that of an administrator by creating a package post whose property_package_user_role is set to administrator and then submitting the PayPal registration form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/df48f7f9-7bc9-4f9b-b9b5-6bfb86309030?source=cve - https://plugins.trac.wordpress.org/browser/property/tags/1.0.6/admin/pages/payment-inc/paypal-submit.php#L128 - https://wordpress.org/plugins/property/#developers - https://plugins.trac.wordpress.org/browser/property/tags/1.0.6/property.php#L1964 - https://plugins.trac.wordpress.org/changeset/3299714/
CVE ID: CVE-2025-5119 State: PUBLISHED Published: 2025-05-23T21:00:11.879Z Last Updated: 2025-05-23T21:15:46.805Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Emlog Products: Pro Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. Additional Analyst Notes: -
was contacted early about this disclosure and confirmed the existence of the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310198 - https://vuldb.com/?ctiid.310198 - https://vuldb.com/?submit.555822 - https://github.com/404heihei/CVE/issues/5
CVE ID: CVE-2025-5120 State: PUBLISHED Published: 2025-07-27T07:57:07.134Z Last Updated: 2025-07-28T14:09:25.944Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: huggingface Products: huggingface/smolagents Problem Types: CWE-94 Description: A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute ar
ution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/63ab1cfe-b573-4cf5-a7d3-fb6c957e34b0 - https://github.com/huggingface/smolagents/commit/33a942e62b6fbf6a35d41f1c735bda2d64c163d0
CVE ID: CVE-2025-5121 State: PUBLISHED Published: 2025-06-20T17:12:39.860Z Last Updated: 2025-06-20T17:29:37.340Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/545429 - https://hackerone.com/reports/3153908
CVE ID: CVE-2025-5122 State: PUBLISHED Published: 2025-05-29T08:22:02.201Z Last Updated: 2025-05-29T14:06:33.398Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: goiblas Products: Map Block Leaflet Problem Types: CWE-79 Description: The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Not
nject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/372f1cf3-df33-444c-b31e-8f71d128e30b?source=cve - https://plugins.trac.wordpress.org/browser/map-block-leaflet/trunk/build/leaflet-map-block/render.php#L41 - https://wordpress.org/plugins/map-block-leaflet/#developers - https://plugins.trac.wordpress.org/changeset/3302407/
CVE ID: CVE-2025-5123 State: PUBLISHED Published: 2025-06-13T01:47:50.487Z Last Updated: 2025-06-13T15:30:09.575Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: a3rev Products: Contact Us Page – Contact People Problem Types: CWE-79 Description: The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
r-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcffc816-ff56-4875-b234-91dd1d073721?source=cve - https://plugins.trac.wordpress.org/browser/contact-us-page-contact-people/trunk/classes/class-people-contact.php#L743 - https://wordpress.org/plugins/contact-us-page-contact-people/#developers
CVE ID: CVE-2025-5124 State: PUBLISHED Published: 2025-05-24T13:00:14.671Z Last Updated: 2025-05-28T17:40:32.611Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sony Products: SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N, SNC-RX570N Problem Types: CWE-1392 Description: A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is
tials. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. It is recommended to change the configuration settings. The vendor was contacted early about this issue. They confirmed the existence but pointed out that they "have published the 'Hardening Guide' on the Web from July 2018 to January 2025 and have thoroughly informed customers of the recommendation to change their initial passwords". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
o change their initial passwords". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310203 - https://vuldb.com/?ctiid.310203 - https://vuldb.com/?submit.564839 - https://github.com/zeke2997/CVE_request_Sony - https://github.com/zeke2997/CVE_request_Sony#3-poc