Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-44841 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:38:44.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/CloudSrvUserdataVersionCheck_version/readme.md
CVE ID: CVE-2025-44842 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:38:03.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/msg_process_Port/readme.md
CVE ID: CVE-2025-44843 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:37:19.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/CloudSrvUserdataVersionCheck_url/readme.md
CVE ID: CVE-2025-44844 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:36:34.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/setUpgradeFW/readme.md
CVE ID: CVE-2025-44845 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:35:41.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/NTPSyncWithHost/readme.md
CVE ID: CVE-2025-44846 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:31:10.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/recvUpgradeNewFw/readme.md
CVE ID: CVE-2025-44847 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:30:09.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/setWebWlanIdx/readme.md
CVE ID: CVE-2025-44848 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T18:09:55.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/msg_process_Url/readme.md
CVE ID: CVE-2025-44854 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:35:36.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CP900/setUpgradeUboot/readme.md
CVE ID: CVE-2025-44860 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:28:36.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/msg_process_Port/readme.md
CVE ID: CVE-2025-44861 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:29:24.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/CloudSrvUserdataVersionCheck/readme.md
CVE ID: CVE-2025-44862 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:28:15.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/recvUpgradeNewFw/readme.md
CVE ID: CVE-2025-44863 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T15:30:43.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/msg_process_Url/readme.md
CVE ID: CVE-2025-44864 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:27:18.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_module/readme.md
CVE ID: CVE-2025-44865 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:26:35.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_enable/readme.md
CVE ID: CVE-2025-44866 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:25:44.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_level/readme.md
CVE ID: CVE-2025-44867 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T20:24:58.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetNetCheckTools/readme.md
CVE ID: CVE-2025-44868 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-06T15:15:33.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WL-WN530H4/ping_test/readme.md
CVE ID: CVE-2025-44872 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-06T15:17:45.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Tenda_AC/AC9_formsetUsbUnload
CVE ID: CVE-2025-44877 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-06T15:16:43.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Summermu/VulnForIoT/tree/main/Tenda_AC/AC9_formSetSambaConf
CVE ID: CVE-2025-44879 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T13:36:20.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: WS-WN572HP3 V230525 was discovered to contain a buffer overflow in the component /www/cgi-bin/upload.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/03/17/Buffer%20Overflow%20in%20upload.cgi%20of%20WINSTAR_WN572HP3%20Device/
CVE ID: CVE-2025-44880 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:47:07.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/03/27/Remote-Command-Execution-in-adm-cgi-of-wavlink-WL-WN579A3-Device/
CVE ID: CVE-2025-44881 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:53:53.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/03/31/Remote-Command-Execution-in-qos-cgi-of-wavlink-WL-WN579A3-Device/
CVE ID: CVE-2025-44882 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:42:14.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/03/31/Remote-Command-Execution-in-firewall-cgi-of-wavlink-WL-WN579A3-Device/
CVE ID: CVE-2025-44883 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:45:08.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-tacplus-serverEdit-post-tacIp/
CVE ID: CVE-2025-44884 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:52:35.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-sys-infoContact-post-contact/
CVE ID: CVE-2025-44885 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:57:39.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-snmpv3-remote-engineId-add-post-remote-ip/
CVE ID: CVE-2025-44886 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-22T15:29:30.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postcontains function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-acl-mgmt-Rules-Edit-post-ruleEditName/
CVE ID: CVE-2025-44887 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:49:33.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radIpkey parameter in the web_radiusSrv_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-radiusSrv-post-radIp/
CVE ID: CVE-2025-44888 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:48:39.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the stp_conf_name parameter in the web_stp_globalSetting_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-stp-globalSetting-post-stp-conf-name/
CVE ID: CVE-2025-44890 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:56:34.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_notifyv3_add_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-snmp-notifyv3-add-post-host-ip/
CVE ID: CVE-2025-44891 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:37:11.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-snmp-v3host-add-post-host-ip/
CVE ID: CVE-2025-44892 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T17:49:56.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-rmon-alarm-post-rmon-alarm-owne/
CVE ID: CVE-2025-44893 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-11-24T13:59:07.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the web_acl_mgmt_Rules_Apply_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-acl-mgmt-Rules-Apply-post-ruleName/ - https://github.com/xyqer1/Planet-web_acl_mgmt_Rules_Apply_post-ruleName-StackOverflow - https://raw.githubusercontent.com/lafdrew/lafdrew.github.io/7e2c4ab83017611974e61aa1384c2563ec008f49/2025/04/18/web-aaa-loginAuthlistEdit-get-auth
ent.com/lafdrew/lafdrew.github.io/7e2c4ab83017611974e61aa1384c2563ec008f49/2025/04/18/web-aaa-loginAuthlistEdit-get-authName-StackOverflow/index.html
CVE ID: CVE-2025-44894 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:35:50.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-radiusSrv-dftParam-post-radDftParamKey/
CVE ID: CVE-2025-44895 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T17:48:53.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/18/web-acl-ipv4BasedAceAdd-post-ipv4Acl-StackOverflow/
CVE ID: CVE-2025-44896 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:34:52.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/18/web-acl-bindEdit-post-bindEditMACName-StackOverflow/
CVE ID: CVE-2025-44897 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:33:08.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftp_srvip parameter in the web_tool_upgradeManager_post function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/20/web-tool-upgradeManager-post-tftp-srvip/
CVE ID: CVE-2025-44898 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T13:31:52.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lafdrew.github.io/2025/04/18/web-aaa-loginAuthlistEdit-get-authName-StackOverflow/
CVE ID: CVE-2025-44899 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-07T13:19:24.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the web url /goform/ WifiGuestSet, the manipulation of the parameter shareSpeed leads to stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tenda_RX3_fromSetWifiGusetBasic_shareSpeed_overflow/detail.md
CVE ID: CVE-2025-44900 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-06T20:30:35.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tenda RX3 V1.0br_V16.03.13.11 in the GetParentControlInfo function of the web url /goform/GetParentControlInfo, the manipulation of the parameter mac leads to stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tenda_Rx3_GetParentControlInfo_mac_overflow/detail.md
CVE ID: CVE-2025-44904 State: PUBLISHED Published: 2025-05-30T00:00:00.000Z Last Updated: 2025-05-30T22:01:59.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc1.md
CVE ID: CVE-2025-44905 State: PUBLISHED Published: 2025-05-30T00:00:00.000Z Last Updated: 2025-05-30T22:01:54.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc5.md
CVE ID: CVE-2025-44906 State: PUBLISHED Published: 2025-05-30T00:00:00.000Z Last Updated: 2025-05-30T22:01:48.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/madao123123/crash_report/blob/main/jhead/jhead.md
CVE ID: CVE-2025-44951 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-20T13:06:07.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow by changing the `session.dev` field with a value with length greater than 32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/3775 - https://gist.github.com/scmdcs/6d878d6074f0e2f4a8fb69e9864068b7
CVE ID: CVE-2025-44952 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-20T12:45:49.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow by changing the `session.dnn` field with a value with length greater than 101. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/3775 - https://gist.github.com/scemodicecosa/8643fbfc9490f40e955e9f9e9b0d9077 - https://gist.github.com/scmdcs/8643fbfc9490f40e955e9f9e9b0d9077