Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27930 State: PUBLISHED Published: 2025-07-23T10:20:09.411Z Last Updated: 2025-07-25T03:55:17.888Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-79 Description: Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-27930.html
CVE ID: CVE-2025-27931 State: PUBLISHED Published: 2025-08-05T14:49:26.305Z Last Updated: 2025-11-03T19:46:39.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: PDF-XChange Co. Ltd Products: PDF-XChange Editor Problem Types: CWE-125 Description: An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulner
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2171
CVE ID: CVE-2025-27932 State: PUBLISHED Published: 2025-03-28T08:19:01.846Z Last Updated: 2025-03-28T13:55:44.769Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: KDDI CORPORATION Products: HGW-BL1500HM Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an attacker may delete a file on the device or cause a denial of service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kddi-tech.com/contents/a
rvice (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kddi-tech.com/contents/appendix_L2_06.html#64433e4a-8946-9c06-bddf-91cbfe56c8e5 - https://jvn.jp/en/jp/JVN04278547/
CVE ID: CVE-2025-27933 State: PUBLISHED Published: 2025-03-21T08:23:20.955Z Last Updated: 2025-03-21T13:32:57.219Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-27934 State: PUBLISHED Published: 2025-04-09T09:03:32.130Z Last Updated: 2025-04-09T14:20:29.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Inaba Denki Sangyo Co., Ltd. Products: AC-WPS-11ac, AC-WPS-11ac-P, AC-WPSM-11ac, AC-WPSM-11ac-P, AC-PD-WPS-11ac, AC-PD-WPS-11ac-P Problem Types: CWE-497 Description: Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/
ion information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf - https://jvn.jp/en/vu/JVNVU93925742/
CVE ID: CVE-2025-27936 State: PUBLISHED Published: 2025-04-16T09:14:55.095Z Last Updated: 2025-04-16T14:32:45.176Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-208 Description: Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-27937 State: PUBLISHED Published: 2025-04-27T23:56:55.286Z Last Updated: 2025-04-28T15:01:58.664Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SIOS Technology, Inc. Products: Quick Agent V3, Quick Agent V2 Problem Types: CWE-22 Description: Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, an arbitrary file in the affected product may be obtained by a remote attacker who can log in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mfp-support.sios.jp/hc/ja/articles/45853460006937 - https://siosapps.sio
- CISA ADP Vulnrichment: References: - https://mfp-support.sios.jp/hc/ja/articles/45853460006937 - https://siosapps.sios.jp/agent_info/20250425001.html - https://jvn.jp/en/jp/JVN82536398/
CVE ID: CVE-2025-27938 State: PUBLISHED Published: 2025-04-15T21:03:24.435Z Last Updated: 2025-04-16T15:09:20.673Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27939 State: PUBLISHED Published: 2025-04-15T20:59:44.552Z Last Updated: 2025-04-16T15:09:28.760Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An attacker can change registered email addresses of other users and take over arbitrary accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27953 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-11T15:27:10.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session management component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/intruderlabs/cvex/tree/main/Carestream/session-token-in-url
CVE ID: CVE-2025-27954 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-11T15:27:08.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/kb/issues/00500700_session-token-in-url - https://github.com/intruderlabs/cvex/tree/main/Carestream/session-token-in-url
CVE ID: CVE-2025-27955 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-11T15:27:11.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/intruderlabs/cvex/tree/main/Carestream/session-token-in-url
CVE ID: CVE-2025-27956 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-02T20:37:32.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/intruderlabs/cvex/blob/main/Pixeon/WebLaudos/Directory-Traversal/README.md
CVE ID: CVE-2025-27980 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:26:39.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/qq_52469895/article/details/145496958?sharetype=blogdetail&sharerId=145496958&sharerefer=PC&sharesource=qq_52469895&spm=1011.2480.3001.8118
CVE ID: CVE-2025-27997 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:46:56.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/sornram9254/4593dd5eb2bcca50d68dc6ac70e40b24
CVE ID: CVE-2025-27998 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:48:32.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted executable or DLL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/sornram9254/e8d10efcf246cc50ff3d4f837b261616
CVE ID: CVE-2025-28009 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T18:17:45.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/beardenx/CVE-2025-28009
CVE ID: CVE-2025-28010 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T14:53:43.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/MODX/README.md
CVE ID: CVE-2025-28011 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T18:43:30.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Change-password-sql-injection.pdf
CVE ID: CVE-2025-28015 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T18:44:08.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/HTML%20Injection%20-%20edit-profile.md
CVE ID: CVE-2025-28016 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:29:13.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary JavaScript code via the fname, lname, and contact parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/User%20Registration%20&%20Login%20and%20User%20Management%20System%20With%20admin%20panel/XSS%20njection%20-%
PHPGurukul/User%20Registration%20&%20Login%20and%20User%20Management%20System%20With%20admin%20panel/XSS%20njection%20-%20edit-profile.md
CVE ID: CVE-2025-28017 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:54:33.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/TOTOLINK-A800R-RCE-1938e5e2b1a280d696bbd25699fb5e97 - https://locrian-lightning-dc7.notion.site/CVE-2025-28017-TOTOLINK-A800R-RCE-1938e5e2b1a280d696bbd25699fb5e97
CVE ID: CVE-2025-28018 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:53:59.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow2-1948e5e2b1a28070a8d1d1ba725febff
CVE ID: CVE-2025-28019 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:53:18.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow1-1948e5e2b1a280ad96efca529ecae658 - https://locrian-lightning-dc7.notion.site/CVE-2025-28019-BufferOverflow1-1948e5e2b1a280ad96efca529ecae658
CVE ID: CVE-2025-28020 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:52:36.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow3-1948e5e2b1a280c28ef5c6e54b49324d?pvs=73 - https://locrian-lightning-dc7.notion.site/CVE-2025-28020-BufferOverflow3-1948e5e2b1a280c28ef5c6e54b49324d
CVE ID: CVE-2025-28021 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:50:55.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow1-1948e5e2b1a280e8aa5ad87964c5cd3d?pvs=73 - https://locrian-lightning-dc7.notion.site/CVE-2025-28021-BufferOverflow1-1948e5e2b1a280e8aa5ad87964c5cd3d
CVE ID: CVE-2025-28022 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:52:04.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow3-1948e5e2b1a280ec8061ed308b33b5bc?pvs=73 - https://locrian-lightning-dc7.notion.site/CVE-2025-28022-BufferOverflow3-1948e5e2b1a280ec8061ed308b33b5bc
CVE ID: CVE-2025-28024 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:41:34.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow5-1978e5e2b1a2800caaced7ae3fb4783c
CVE ID: CVE-2025-28025 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:51:11.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow1-19e8e5e2b1a280bfbe52ec9975287f77?pvs=73 - https://locrian-lightning-dc7.notion.site/BufferOverflow1-19e8e5e2b1a280bfbe52ec9975287f77
CVE ID: CVE-2025-28026 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:07:32.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow3-19e8e5e2b1a28048b8ddd4afdbe18d55
CVE ID: CVE-2025-28027 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T16:54:27.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow2-19e8e5e2b1a2806db38bea19abb4630a?pvs=73 - https://locrian-lightning-dc7.notion.site/CVE-2025-28027-BufferOverflow2-19e8e5e2b1a2806db38bea19abb4630a
CVE ID: CVE-2025-28028 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T15:49:58.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow4-1948e5e2b1a280b9809af4db6f9e65d1 - https://locrian-lightning-dc7.notion.site/CVE-2025-28028-BufferOverflow4-1948e5e2b1a280b9809af4db6f9e65d1
CVE ID: CVE-2025-28029 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:43:21.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow5-1978e5e2b1a28043af78e5ccfc0203a0
CVE ID: CVE-2025-28030 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:40:11.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in setParentalRules function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow6-19f8e5e2b1a2803db1d9ce7b4d06e2e0?pvs=73
CVE ID: CVE-2025-28031 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T19:16:13.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/Hard-code-Password-19f8e5e2b1a2803f864afbbc4262152e?pvs=73
CVE ID: CVE-2025-28032 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T15:02:25.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpForm parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow6-19f8e5e2b1a28052bda1f6ede9db341d
CVE ID: CVE-2025-28033 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:48:47.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpTo parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/BufferOverflow7-1a98e5e2b1a280708d6ec6155ce88d8c
CVE ID: CVE-2025-28034 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T15:01:19.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function through the hostTime parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/RCE2-1a98e5e2b1a280bebf53d868f1b1a711?pvs=74
CVE ID: CVE-2025-28035 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:42:22.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/RCE1-1a98e5e2b1a28081880dd817104b3af4?pvs=73
CVE ID: CVE-2025-28036 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:14:20.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/RCE1-1a98e5e2b1a28081880dd817104b3af4
CVE ID: CVE-2025-28037 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T15:59:33.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/RCE3-1ad8e5e2b1a280e192e8cff9fef896cc