Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32978 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-11-03T19:53:54.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.quest.com/
ce. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 - https://seralys.com/research/CVE-2025-32978.txt - https://seclists.org/fulldisclosure/2025/Jun/25
CVE ID: CVE-2025-32979 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-29T15:32:24.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32980 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-08-25T18:18:17.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32981 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-29T15:39:09.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32982 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-29T15:46:42.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32983 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T21:45:22.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32984 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T21:43:04.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32985 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-29T15:48:06.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32986 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-29T15:50:35.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2025-32987 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T02:51:47.679Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Arctera Products: eDiscovery Platform Problem Types: CWE-214 Description: Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/ARC25-005
CVE ID: CVE-2025-32988 State: PUBLISHED Published: 2025-07-10T08:04:57.991Z Last Updated: 2025-11-11T05:35:07.738Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 2, Red Hat Insights proxy 1.5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-415 Description: A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership ha
-415 Description: A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
on allocator behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:16115 - https://access.redhat.com/errata/RHSA-2025:16116 - https://access.redhat.com/errata/RHSA-2025:17181 - https://access.redhat.com/errata/RHSA-2025:17348 - https://access.redhat.com/errata/RHSA-2025:17361 - https://access.redhat.com/errata/RHSA-2025:17415 - https://access.redhat.com/errata/RHSA-2025:19088 - https://access.redhat.com/security/cve/CVE-2025-32988 - https://bugzilla.redhat.com/show_bug.cgi?id=2359622
CVE ID: CVE-2025-32989 State: PUBLISHED Published: 2025-07-10T08:05:26.307Z Last Updated: 2025-11-06T23:08:38.632Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 2, Red Hat Insights proxy 1.5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 Problem Types: CWE-295 Description: A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparenc
-295 Description: A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:16115 - https://access.redhat.com/er
: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:16115 - https://access.redhat.com/errata/RHSA-2025:16116 - https://access.redhat.com/errata/RHSA-2025:17181 - https://access.redhat.com/errata/RHSA-2025:17348 - https://access.redhat.com/errata/RHSA-2025:17361 - https://access.redhat.com/errata/RHSA-2025:19088 - https://access.redhat.com/security/cve/CVE-2025-32989 - https://bugzilla.redhat.com/show_bug.cgi?id=2359621
CVE ID: CVE-2025-32990 State: PUBLISHED Published: 2025-07-10T09:41:46.211Z Last Updated: 2025-11-06T23:08:41.391Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 2, Red Hat Insights proxy 1.5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-122 Description: A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logi
-122 Description: A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:16115 - https://access.redhat.com/errata/RHSA-2025:16116 - https://access.redhat.com/errata/RHSA-2025:17181 - https://access.redhat.com/errata/RHSA-2025:17348 - https://access.redhat.com/
access.redhat.com/errata/RHSA-2025:17181 - https://access.redhat.com/errata/RHSA-2025:17348 - https://access.redhat.com/errata/RHSA-2025:17361 - https://access.redhat.com/errata/RHSA-2025:17415 - https://access.redhat.com/errata/RHSA-2025:19088 - https://access.redhat.com/security/cve/CVE-2025-32990 - https://bugzilla.redhat.com/show_bug.cgi?id=2359620
CVE ID: CVE-2025-32992 State: PUBLISHED Published: 2025-08-18T00:00:00.000Z Last Updated: 2025-08-18T20:25:51.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.thermofisher.com/us/en/home/industrial/environmental/environmental-learning-center/environmental-resource-library/fast5-issues/iq-series-eport-versus-iport.html - https://assets.thermofisher.com/TFS-Assets/CORP/Product-Guides/Thermo_Scientific_ePort_software.pdf
CVE ID: CVE-2025-32993 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T13:18:57.300Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Vision Helpdesk Products: Vision Helpdesk Problem Types: CWE-89 Description: Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authentication is not needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nav1n.medium.com/sql-injection-in-vision-helpdesk-tools-a83dfc27f3ab - https://www.visionhelpdesk.com/vision-helpdesk-v5-7-0-stable-version-released.html
CVE ID: CVE-2025-32996 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T03:55:51.136Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: chimurai Products: http-proxy-middleware Problem Types: CWE-670 Description: In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chimurai/http-proxy-middleware/commit/020976044d113fc0bcbbaf995e91d05e2829a145 - https://github.com/chimurai/http-proxy-middleware/pull/1089 - https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.8 - https://
murai/http-proxy-middleware/pull/1089 - https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.8 - https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.4
CVE ID: CVE-2025-32997 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T03:54:38.610Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: chimurai Products: http-proxy-middleware Problem Types: CWE-754 Description: In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e - https://github.com/chimurai/http-proxy-middleware/pull/1096 - https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9 - https://github
http-proxy-middleware/pull/1096 - https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9 - https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5
CVE ID: CVE-2025-32999 State: PUBLISHED Published: 2025-05-19T08:08:51.815Z Last Updated: 2025-05-19T15:28:40.444Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: appleple inc. Products: a-blog cms Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment:
ted on the web browser of the user who is logging in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html - https://jvn.jp/en/vu/JVNVU90760614/
CVE ID: CVE-2025-33000 State: PUBLISHED Published: 2025-11-11T16:51:10.393Z Last Updated: 2025-11-14T15:28:32.840Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel QuickAssist Technology Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowle
This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
CVE ID: CVE-2025-33003 State: PUBLISHED Published: 2025-10-31T13:04:31.204Z Last Updated: 2025-11-01T03:55:53.966Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-250 Description: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container due to execution with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246684
CVE ID: CVE-2025-33004 State: PUBLISHED Published: 2025-06-01T11:37:51.426Z Last Updated: 2025-08-26T14:53:57.680Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-22 Description: IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235182
CVE ID: CVE-2025-33005 State: PUBLISHED Published: 2025-06-01T11:39:06.583Z Last Updated: 2025-08-26T14:53:31.308Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-613 Description: IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235182
CVE ID: CVE-2025-33008 State: PUBLISHED Published: 2025-08-19T19:03:36.978Z Last Updated: 2025-08-19T19:48:02.651Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator, Sterling File Gateway Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.2.1.0 and IBM Sterling File Gateway 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com
isclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242392
CVE ID: CVE-2025-33012 State: PUBLISHED Published: 2025-11-07T18:38:29.123Z Last Updated: 2025-11-07T18:56:16.588Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Db2 Problem Types: CWE-324 Description: IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250469
CVE ID: CVE-2025-33013 State: PUBLISHED Published: 2025-07-24T14:55:04.945Z Last Updated: 2025-08-18T01:27:18.300Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Operator Problem Types: CWE-244 Description: IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240431
CVE ID: CVE-2025-33014 State: PUBLISHED Published: 2025-07-18T18:51:05.486Z Last Updated: 2025-08-18T01:33:59.946Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator, Sterling File Gateway Problem Types: CWE-1022 Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/sup
ns on the victims’ web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240065
CVE ID: CVE-2025-33020 State: PUBLISHED Published: 2025-07-23T14:47:29.357Z Last Updated: 2025-08-18T01:31:04.799Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Systems Design Rhapsody Problem Types: CWE-311 Description: IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240374
CVE ID: CVE-2025-33023 State: PUBLISHED Published: 2025-08-12T11:16:59.504Z Last Updated: 2025-08-12T20:08:44.934Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-434 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDCOM ROX RX1500 (All versions), RUGGEDCOM ROX RX1
ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDCOM ROX RX1500 (All versions), RUGGEDCOM ROX RX1501 (All versions), RUGGEDCOM ROX RX1510 (All versions), RUGGEDCOM ROX RX1511 (All versions), RUGGEDCOM ROX RX1512 (All versions), RUGGEDCOM ROX RX1524 (All versions), RUGGEDCOM ROX RX1536 (All versions), RUGGEDCOM ROX RX5000 (All versions). The affected devices do not properly enforce the restriction of files that can be uploaded from the web interface. This could allow an authenticated remote attacker with high privileges in the web interface to upload arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/product
rbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-665108.html
CVE ID: CVE-2025-33024 State: PUBLISHED Published: 2025-05-13T09:38:47.622Z Last Updated: 2025-05-13T13:29:57.474Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-602 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (
, RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'tcpdump' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root
ing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-301229.html