Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
raft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/3316
CVE ID: CVE-2020-10284 State: PUBLISHED Published: 2020-07-15T19:25:13.961653Z Last Updated: 2024-09-16T23:21:30.074Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: uFactory Products: xArm5 Lite, xArm 6 and xArm 7 Problem Types: CWE-656 Description: No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the current operator from an active session. Additional Analyst Notes: - CVE Program Container: References: - https://
g the current operator from an active session. Additional Analyst Notes: - CVE Program Container: References: - https://www.ufactory.cc/#/en/support/download/xarm
CVE ID: CVE-2020-10285 State: PUBLISHED Published: 2020-07-15T21:00:14.468329Z Last Updated: 2024-09-17T02:32:51.974Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: uFactory Products: xArm5 Lite, xArm 6 and xArm 7 Problem Types: CWE-307 Description: The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/3322
CVE ID: CVE-2020-10286 State: PUBLISHED Published: 2020-07-15T21:15:13.859317Z Last Updated: 2024-09-17T00:22:04.212Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: uFactory Products: xArm 5 Lite, xArm 6 and xArm 7 Problem Types: CWE-656 Description: the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/3323
CVE ID: CVE-2020-10287 State: PUBLISHED Published: 2020-07-15T22:15:17.666079Z Last Updated: 2024-09-16T23:46:37.980Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: ABB Products: IRB140 Problem Types: CWE-255 Description: The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default credentials and consider thereby this an exposure that should be mitigated. Moreover, future deployments should consider that these defaults sho
thereby this an exposure that should be mitigated. Moreover, future deployments should consider that these defaults should be forbidden (user should be forced to change them). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/3326
CVE ID: CVE-2020-10288 State: PUBLISHED Published: 2020-07-15T22:15:13.640890Z Last Updated: 2024-09-16T19:51:41.495Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: IRB140 Problem Types: CWE-284 Description: IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/3327
CVE ID: CVE-2020-10289 State: PUBLISHED Published: 2020-08-20T08:05:14.408034Z Last Updated: 2024-09-16T21:57:52.714Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Open Robotics Products: ros Problem Types: CWE-20 Description: Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Loc
or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ros/actionlib/pull/171
CVE ID: CVE-2020-10290 State: PUBLISHED Published: 2020-08-21T15:05:19.977025Z Last Updated: 2024-09-16T19:15:10.454Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Universal Robots Products: URx Problem Types: CWE-250 Description: Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system Additional Analyst Not
a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/1495
CVE ID: CVE-2020-10291 State: PUBLISHED Published: 2020-11-06T11:20:19.128016Z Last Updated: 2024-09-16T18:13:32.974Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: KUKA Roboter GmbH Products: Visual Components Network License Server 2.0.8 Problem Types: CWE-200 Description: Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/aut
etwork license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-
a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol leaks information regarding the receiving serverinformation, license information and managing licenses, among others.Through this flaw, attackers can retreive information about a KUKA simulation system, particularly, the version ofthe licensing server, which is connected to the simulator, and which will allow them to launch local simulationswith similar characteristics, further understanding the dynamics of motion virtualization and opening doors toother attacks (see RVDP#711 and RVDP#712 for subsequent vulnerabilities that compr
on virtualization and opening doors toother attacks (see RVDP#711 and RVDP#712 for subsequent vulnerabilities that compromise integrity andavailability).Beyond compromising simulations, Visual Components provides capabilities to interface with industrial machinery.Particularly, their PLC Connectivity feature 'makes it easy' to connect simulations with control systems usingeither the industry standard OPC UA or other supported vendor specific interfaces. This fills the gap of jumpingfrom simulation to real and enables attackers to pivot from the Visual Components simulator to robots or otherIndustrial Control System (ICS) devices, such as PLCs. Additional Analyst Notes: - CVE Program Containe
o robots or otherIndustrial Control System (ICS) devices, such as PLCs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aliasrobotics/RVD/issues/3336
CVE ID: CVE-2020-10292 State: PUBLISHED Published: 2020-11-06T11:20:12.790552Z Last Updated: 2024-09-17T04:29:05.653Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: KUKA Roboter GmbH Products: Visual Components Network License Server 2.0.8 Problem Types: CWE-248 Description: Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/aut
a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol is vulnerable to DoS through an arbitrary pointerderreference. This flaw allows an attacker to to pass a specially crafted package that, when processed by theservice, causes an arbitrary pointer from the stack to be dereferenced, causing an uncaught exception thatterminates the service. This can be further contructed in combination with RVDP#710 which exploits an informationdisclosure leak, or with RVDP#711 for an stack-overflow and potential code execution.Beyond denying simulations, Visual Components provides capabilities to in
an stack-overflow and potential code execution.Beyond denying simulations, Visual Components provides capabilities to interface with industrial machinery andautomate certain processes (e.g. testing, benchmarking, etc.) which depending on the DevOps setup might beintegrated into the industrial flow. Accordingly, a DoS in the simulation might have higher repercusions, dependingon the Industrial Control System (ICS) ICS infrastructure. Additional Analyst Notes: - CVE Program Container: References: - https://www.visualcomponents.com/products/visual-components/
CVE ID: CVE-2020-10364 State: PUBLISHED Published: 2020-03-23T15:56:19 Last Updated: 2024-08-04T10:58:40.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48228 - https://packetstormsecurity.com/files/156790/Microtik-SSH-Daemon-6.44.3-Denial-Of-Service.html
CVE ID: CVE-2020-10365 State: PUBLISHED Published: 2020-03-18T21:24:09 Last Updated: 2024-08-04T10:58:40.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary queries to the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities
CVE ID: CVE-2020-10366 State: PUBLISHED Published: 2020-04-07T23:58:00 Last Updated: 2024-08-04T10:58:40.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/logicaldoc/code/HEAD/tree/community/logicaldoc/trunk/ReleaseNotes.txt - https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities
CVE ID: CVE-2020-10367 State: PUBLISHED Published: 2024-11-10T00:00:00 Last Updated: 2024-11-26T17:50:32.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.informatik.tu-darmstadt.de/seemoo/team_seemoo/jiska_classen/index.en.jsp - https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a - https://bugzilla.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuig
a.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE ID: CVE-2020-10368 State: PUBLISHED Published: 2024-11-10T00:00:00 Last Updated: 2024-11-26T17:50:41.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.informatik.tu-darmstadt.de/seemoo/team_seemoo/jiska_classen/index.en.jsp - https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a - https://bugzilla.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/
gzilla.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE ID: CVE-2020-10369 State: PUBLISHED Published: 2024-11-10T00:00:00 Last Updated: 2024-11-26T17:50:54.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra" attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.informatik.tu-darmstadt.de/seemoo/team_seemoo/jiska_classen/index.en.jsp - https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a - https://bugzilla.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20
- https://bugzilla.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE ID: CVE-2020-10370 State: PUBLISHED Published: 2024-11-10T00:00:00.000Z Last Updated: 2025-01-27T17:54:31.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a "Spectra" attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.informatik.tu-darmstadt.de/seemoo/team_seemoo/jiska_classen/index.en.jsp - https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a - https://security-tracker.debian.org/tracker/CVE-2020-10370 - https://bugzilla.redhat.com/show_bug.cg
a0c8f6f8e1fa5c37a - https://security-tracker.debian.org/tracker/CVE-2020-10370 - https://bugzilla.redhat.com/show_bug.cgi?id=2052676 - https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE ID: CVE-2020-10372 State: PUBLISHED Published: 2020-03-10T20:26:32 Last Updated: 2024-08-04T10:58:40.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEditValueForKey URI. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/ramp-altimeter-stored-xss/
CVE ID: CVE-2020-10374 State: PUBLISHED Published: 2020-03-30T21:18:13 Last Updated: 2024-08-04T10:58:40.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what parameter of the screenshot function in the Contact Support form. Additional Analyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable#20.1.57.1745 - https://kb.paessler.com/en/topic/87668-how-can-i-mitigate-cve-2020-10374-until-i-can-update - https://tehtris.com/en/rce-on-prtg-network-monitor-tehtris-pentest/
CVE ID: CVE-2020-10375 State: PUBLISHED Published: 2021-02-05T19:26:48 Last Updated: 2024-08-04T10:58:40.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product. Additional Analyst Notes: - CVE Program Container: References: - https://www.x41-dsec.de/lab/advisories/x41-2020-005-smarty/ - https://www.smarty-online.de
CVE ID: CVE-2020-10376 State: PUBLISHED Published: 2020-03-11T13:35:02 Last Updated: 2024-08-04T10:58:40.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40felipeagromao/remote-control-cve-2020-10376-fed7b6b934e3
CVE ID: CVE-2020-10377 State: PUBLISHED Published: 2020-04-17T12:31:49 Last Updated: 2024-08-04T10:58:40.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credentials. A successful exploit could allow an attacker to access the system with compromised user credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0004
CVE ID: CVE-2020-10378 State: PUBLISHED Published: 2020-06-25T18:22:30 Last Updated: 2024-08-04T10:58:40.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python-pillow/Pillow/commits/master/src/libImaging - https://github.com/python-pillow/Pillow/pull/4538 - https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac - https://pillow.readthedocs.io/en/stable/rele
4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac - https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/ - https://usn.ubuntu.com/4430-1/ - https://usn.ubuntu.com/4430-2/
CVE ID: CVE-2020-10379 State: PUBLISHED Published: 2020-06-25T18:24:32 Last Updated: 2024-08-04T10:58:40.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python-pillow/Pillow/commits/master/src/libImaging - https://github.com/python-pillow/Pillow/pull/4538 - https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
ts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/ - https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/ - https://usn.ubuntu.com/4430-2/
CVE ID: CVE-2020-10380 State: PUBLISHED Published: 2020-03-17T14:00:07 Last Updated: 2024-08-04T10:58:40.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: RMySQL through 0.10.19 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r-dbi/RMySQL/blob/master/NEWS.md
CVE ID: CVE-2020-10381 State: PUBLISHED Published: 2020-04-14T16:48:27 Last Updated: 2024-08-04T10:58:40.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated SQL injection in DATA24, allowing attackers to discover database and table names. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/
CVE ID: CVE-2020-10382 State: PUBLISHED Published: 2020-04-14T16:53:12 Last Updated: 2024-08-04T10:58:40.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code execution in the backup-scheduler. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/
CVE ID: CVE-2020-10383 State: PUBLISHED Published: 2020-04-14T17:00:42 Last Updated: 2024-08-04T10:58:40.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated remote code execution in the com_mb24sysapi module. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/
CVE ID: CVE-2020-10384 State: PUBLISHED Published: 2020-04-14T17:08:21 Last Updated: 2024-08-04T10:58:40.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account to the root account. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003