deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3982
Published: 2025-04-27
Description: A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94, CWE-1321, CWE-1321
References: https://gist.github.com/superboy-zjc/a31b8ea7466f91b437598297bf5cbce8; https://vuldb.com/?ctiid.306318; https://vuldb.com/?id.306318
CVE: CVE-2025-3983
Published: 2025-04-27
Description: A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manager/system/nlog_down.php. The manipulation of the argument ProtocolType leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/MichaelZhuang521/cve/blob/main/rce.md; https://vuldb.com/?ctiid.306319; https://vuldb.com/?id.306319
CVE: CVE-2025-3984
Published: 2025-04-27
Description: A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component Groovy Code Handler. The manipulation leads to code injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74, CWE-94, CWE-94
References: https://vuldb.com/?ctiid.306320; https://vuldb.com/?id.306320; https://vuldb.com/?submit.557100
CVE: CVE-2025-46687
Published: 2025-04-27
Description: quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-770
References: https://bellard.org/quickjs/Changelog; https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a; https://github.com/bellard/quickjs/issues/399
CVE: CVE-2025-46688
Published: 2025-04-27
Description: quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://bellard.org/quickjs/Changelog; https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a; https://github.com/bellard/quickjs/issues/399
CVE: CVE-2025-3985
Published: 2025-04-27
Description: A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The manipulation of the argument Query leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-400, CWE-1333
References: https://vuldb.com/?ctiid.306321; https://vuldb.com/?id.306321; https://vuldb.com/?submit.557110
CVE: CVE-2025-3986
Published: 2025-04-27
Description: A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://vuldb.com/?ctiid.306322; https://vuldb.com/?id.306322; https://vuldb.com/?submit.557473
CVE: CVE-2025-3987
Published: 2025-04-27
Description: A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc; https://vuldb.com/?ctiid.306323; https://vuldb.com/?id.306323
CVE: CVE-2025-3988
Published: 2025-04-27
Description: A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected is an unknown function of the file /boafrm/formPortFw. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formPortFw; https://vuldb.com/?ctiid.306324; https://vuldb.com/?id.306324
CVE: CVE-2025-46689
Published: 2025-04-27
Description: Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/gozan10/cve/issues/17; https://github.com/ververica/ververica-platform-playground; https://www.ververica.com/
CVE: CVE-2025-46690
Published: 2025-04-27
Description: Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://github.com/gozan10/cve/issues/18; https://github.com/ververica/ververica-platform-playground; https://www.ververica.com
CVE: CVE-2025-3989
Published: 2025-04-27
Description: A vulnerability classified as critical was found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this vulnerability is an unknown functionality of the file /boafrm/formStaticDHCP. The manipulation of the argument Hostname leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formStaticDHCP; https://vuldb.com/?ctiid.306325; https://vuldb.com/?id.306325
CVE: CVE-2025-3990
Published: 2025-04-27
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this issue is some unknown functionality of the file /boafrm/formVlan. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formVlan; https://vuldb.com/?ctiid.306326; https://vuldb.com/?id.306326
CVE: CVE-2025-26692
Published: 2025-04-28
Description: Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN82536398/; https://mfp-support.sios.jp/hc/ja/articles/[PII_REDACTED]6937; https://siosapps.sios.jp/agent_info/[PII_REDACTED]1.html
CVE: CVE-2025-27937
Published: 2025-04-28
Description: Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, an arbitrary file in the affected product may be obtained by a remote attacker who can log in to the product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN82536398/; https://mfp-support.sios.jp/hc/ja/articles/[PII_REDACTED]6937; https://siosapps.sios.jp/agent_info/[PII_REDACTED]1.html
CVE: CVE-2025-31144
Published: 2025-04-28
Description: Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-923
References: https://jvn.jp/en/jp/JVN82536398/; https://mfp-support.sios.jp/hc/ja/articles/[PII_REDACTED]6937; https://siosapps.sios.jp/agent_info/[PII_REDACTED]1.html
CVE: CVE-2025-3991
Published: 2025-04-28
Description: A vulnerability, which was classified as critical, was found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boafrm/formWdsEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWdsEncrypt; https://vuldb.com/?ctiid.306327; https://vuldb.com/?id.306327
CVE: CVE-2025-3992
Published: 2025-04-28
Description: A vulnerability has been found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWlwds. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWlwds; https://vuldb.com/?ctiid.306328; https://vuldb.com/?id.306328
CVE: CVE-2025-3993
Published: 2025-04-28
Description: A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWsc_1; https://vuldb.com/?ctiid.306329; https://vuldb.com/?id.306329
CVE: CVE-2025-3994
Published: 2025-04-28
Description: A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been classified as problematic. Affected is an unknown function of the file /home.htm of the component IP Port Filtering. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_IP_Port_filering; https://vuldb.com/?ctiid.306330; https://vuldb.com/?id.306330
CVE: CVE-2025-3995
Published: 2025-04-28
Description: A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /boafrm/fromStaticDHCP of the component LAN Settings Page. The manipulation of the argument Hostname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_LAN_settings; https://vuldb.com/?ctiid.306331; https://vuldb.com/?id.306331
CVE: CVE-2025-3706
Published: 2025-04-28
Description: The eHRMS from 104 Corporation has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10080-31e4b-2.html; https://www.twcert.org.tw/tw/cp-132-10079-f0958-1.html
CVE: CVE-2025-3996
Published: 2025-04-28
Description: A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home.htm of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_MAC_filering; https://vuldb.com/?ctiid.306332; https://vuldb.com/?id.306332
CVE: CVE-2025-3997
Published: 2025-04-28
Description: A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-profile-ajax-1 of the component Personal Information Page. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_4.md; https://vuldb.com/?ctiid.306333; https://vuldb.com/?id.306333
CVE: CVE-2025-3998
Published: 2025-04-28
Description: A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file renew.php?id=6. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/lyg986443/cve/issues/4; https://vuldb.com/?ctiid.306334
CVE: CVE-2025-3999
Published: 2025-04-28
Description: A vulnerability, which was classified as problematic, has been found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. This issue affects some unknown processing of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\common\js\addDate\date.jsp of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.306335; https://vuldb.com/?id.306335; https://vuldb.com/?submit.557987
CVE: CVE-2025-4000
Published: 2025-04-28
Description: A vulnerability, which was classified as problematic, was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. Affected is an unknown function of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\ssoproxy\jsp\ssoproxy.jsp. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.306336; https://vuldb.com/?id.306336; https://vuldb.com/?submit.558067
CVE: CVE-2025-4001
Published: 2025-04-28
Description: A vulnerability has been found in scipopt scip up to 9.2.1 and classified as problematic. Affected by this vulnerability is the function main of the file examples/LOP/src/genRandomLOPInstance.c of the component File Descriptor Handler. The manipulation of the argument File leads to uncontrolled file descriptor consumption. Local access is required to approach this attack. Upgrading to version 9.2.2 is able to address this issue. The identifier of the patch is d6da63b941216d75fbc1aefea9abf1de6712a2d0. It is recommended to upgrade the affected component.
CVSS Score: 3.3 (LOW)
CWE: CWE-400, CWE-769
References: https://github.com/scipopt/scip/commit/d6da63b941216d75fbc1aefea9abf1de6712a2d0; https://github.com/scipopt/scip/issues/130; https://github.com/scipopt/scip/issues/130#issuecomment[PII_REDACTED]
CVE: CVE-2025-4002
Published: 2025-04-28
Description: A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB and classified as problematic. Affected by this issue is the function GetDebugLogFile of the file Library/MemLogLib/BootLog.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The patch is identified as d2143a1e2deefddd9b105fb7160763c4f8d47ea2. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-476
References: https://github.com/RefindPlusRepo/RefindPlus/commit/d2143a1e2deefddd9b105fb7160763c4f8d47ea2; https://github.com/RefindPlusRepo/RefindPlus/issues/204; https://github.com/RefindPlusRepo/RefindPlus/issues/204#issuecomment[PII_REDACTED]
CVE: CVE-2024-13688
Published: 2025-04-28
Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: https://wpscan.com/vulnerability/19051d08-16b0-466c-976b-be7b076e8e92/
CVE: CVE-2024-9771
Published: 2025-04-28
Description: The WP-Recall  WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c33adc08-99c5-42e1-a2e3-e7c3412a6a3f/
CVE: CVE-2025-0627
Published: 2025-04-28
Description: The WordPress Tag, Category, and Taxonomy Manager  WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/30fbe3c5-f190-48e8-a6bb-e8d78e001e7f/
CVE: CVE-2025-4003
Published: 2025-04-28
Description: A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB. It has been classified as problematic. This affects the function InternalApfsTranslateBlock of the file Library/RP_ApfsLib/RP_ApfsIo.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The patch is named 4d35125ca689a255647e9033dd60c257d26df7cb. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-476
References: https://github.com/RefindPlusRepo/RefindPlus/commit/4d35125ca689a255647e9033dd60c257d26df7cb; https://github.com/RefindPlusRepo/RefindPlus/issues/206; https://github.com/RefindPlusRepo/RefindPlus/issues/206#event[PII_REDACTED]7
CVE: CVE-2025-4004
Published: 2025-04-28
Description: A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wyl091256/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.306340
CVE: CVE-2025-4005
Published: 2025-04-28
Description: A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /patient-report.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wyl091256/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.306341
CVE: CVE-2025-4006
Published: 2025-04-28
Description: A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the component Document Management Page. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://vuldb.com/?ctiid.306342; https://vuldb.com/?id.306342; https://vuldb.com/?submit.558152
CVE: CVE-2025-22235
Published: 2025-04-28
Description: EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.

Your application may be affected by this if all the following conditions are met:

  *  You use Spring Security
  *  EndpointRequest.to() has been used in a Spring Security chain configuration
  *  The endpoint which EndpointRequest references is disabled or not exposed via web
  *  Your application handles requests to /null and this path needs protection


You are not affected if any of the following is true:

  *  You don't use Spring Security
  *  You don't use EndpointRequest.to()
  *  The endpoint which EndpointRequest.to() refers to is enabled and is exposed
  *  Your application does not handle requests to /null or this path does not need protection
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://spring.io/security/cve-2025-22235; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-4007
Published: 2025-04-28
Description: A vulnerability classified as critical was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Affected by this vulnerability is the function cgidhcpsCfgSet of the file /goform/modules of the component httpd. The manipulation of the argument json leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/02Tn/vul/issues/5; https://vuldb.com/?ctiid.306343; https://vuldb.com/?id.306343
CVE: CVE-2025-32470
Published: 2025-04-28
Description: A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF; https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CVE: CVE-2025-32471
Published: 2025-04-28
Description: The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.
CVSS Score: 3.7 (LOW)
CWE: CWE-1391
References: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF; https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices