deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-68741
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix improper freeing of purex item

In qla2xxx_process_purls_iocb(), an item is allocated via
qla27xx_copy_multiple_pkt(), which internally calls
qla24xx_alloc_purex_item().

The qla24xx_alloc_purex_item() function may return a pre-allocated item
from a per-adapter pool for small allocations, instead of dynamically
allocating memory with kzalloc().

An error handling path in qla2xxx_process_purls_iocb() incorrectly uses
kfree() to release the item. If the item was from the pre-allocated
pool, calling kfree() on it is a bug that can lead to memory corruption.

Fix this by using the correct deallocation function,
qla24xx_free_purex_item(), which properly handles both dynamically
allocated and pre-allocated items.
References: https://git.kernel.org/stable/c/4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9; https://git.kernel.org/stable/c/5fa1c8226b4532ad7011d295d3ab4ad45df105ae; https://git.kernel.org/stable/c/78b1a242fe612a755f2158fd206ee6bb577d18ca
CVE: CVE-2025-68742
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix invalid prog->stats access when update_effective_progs fails

Syzkaller triggers an invalid memory access issue following fault
injection in update_effective_progs. The issue can be described as
follows:

__cgroup_bpf_detach
  update_effective_progs
    compute_effective_progs
      bpf_prog_array_alloc <-- fault inject
  purge_effective_progs
    /* change to dummy_bpf_prog */
    array->items[index] = &dummy_bpf_prog.prog

---softirq start---
__do_softirq
  ...
    __cgroup_bpf_run_filter_skb
      __bpf_prog_run_save_cb
        bpf_prog_run
          stats = this_cpu_ptr(prog->stats)
          /* invalid memory access */
          flags = u64_stats_update_begin_irqsave(&stats->syncp)
---softirq end---

  static_branch_dec(&cgroup_bpf_enabled_key[atype])

The reason is that fault injection caused update_effective_progs to fail
and then changed the original prog into dummy_bpf_prog.prog in
purge_effective_progs. Then a softirq came, and accessing the members of
dummy_bpf_prog.prog in the softirq triggers invalid mem access.

To fix it, skip updating stats when stats is NULL.
References: https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b; https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97; https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41
CVE: CVE-2025-68743
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

mshv: Fix create memory region overlap check

The current check is incorrect; it only checks if the beginning or end
of a region is within an existing region. This doesn't account for
userspace specifying a region that begins before and ends after an
existing region.

Change the logic to a range intersection check against gfns and uaddrs
for each region.

Remove mshv_partition_region_by_uaddr() as it is no longer used.
References: https://git.kernel.org/stable/c/2183924dd834e0703f87e17c17e689bcbf55d69d; https://git.kernel.org/stable/c/ab3e7a78d83a61d335458cfe2e4d17eba69ae73d; https://git.kernel.org/stable/c/ba9eb9b86d232854e983203dc2fb1ba18e316681
CVE: CVE-2025-68744
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Free special fields when update [lru_,]percpu_hash maps

As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing
calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the
memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the
map gets freed.

Fix this by calling 'bpf_obj_free_fields()' after
'copy_map_value[,_long]()' in 'pcpu_copy_value()'.
References: https://git.kernel.org/stable/c/3bf1378747e251571e0de15e7e0a6bf2919044e7; https://git.kernel.org/stable/c/4a03d69cece145e4fb527464be29c3806aa3221e; https://git.kernel.org/stable/c/6af6e49a76c9af7d42eb923703e7648cb2bf401a
CVE: CVE-2025-68745
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clear cmds after chip reset

Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling
and host reset handling") caused two problems:

1. Commands sent to FW, after chip reset got stuck and never freed as FW
   is not going to respond to them anymore.

2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a
   ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
   attempted to fix this, but introduced another bug under different
   circumstances when two different CPUs were racing to call
   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in
   dma_unmap_sg_attrs().

So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and
partially revert "scsi: qla2xxx: target: Fix offline port handling and
host reset handling" at __qla2x00_abort_all_cmds.
References: https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936; https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae
CVE: CVE-2025-68746
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: tegra210-quad: Fix timeout handling

When the CPU that the QSPI interrupt handler runs on (typically CPU 0)
is excessively busy, it can lead to rare cases of the IRQ thread not
running before the transfer timeout is reached.

While handling the timeouts, any pending transfers are cleaned up and
the message that they correspond to is marked as failed, which leaves
the curr_xfer field pointing at stale memory.

To avoid this, clear curr_xfer to NULL upon timeout and check for this
condition when the IRQ thread is finally run.

While at it, also make sure to clear interrupts on failure so that new
interrupts can be run.

A better, more involved, fix would move the interrupt clearing into a
hard IRQ handler. Ideally we would also want to signal that the IRQ
thread no longer needs to be run after the timeout is hit to avoid the
extra check for a valid transfer.
References: https://git.kernel.org/stable/c/01bbf25c767219b14c3235bfa85906b8d2cb8fbc; https://git.kernel.org/stable/c/551060efb156c50fe33799038ba8145418cfdeef; https://git.kernel.org/stable/c/83309dd551cfd60a5a1a98d9cab19f435b44d46d
CVE: CVE-2025-68747
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix UAF on kernel BO VA nodes

If the MMU is down, panthor_vm_unmap_range() might return an error.
We expect the page table to be updated still, and if the MMU is blocked,
the rest of the GPU should be blocked too, so no risk of accessing
physical memory returned to the system (which the current code doesn't
cover for anyway).

Proceed with the rest of the cleanup instead of bailing out and leaving
the va_node inserted in the drm_mm, which leads to UAF when other
adjacent nodes are removed from the drm_mm tree.
References: https://git.kernel.org/stable/c/0612704b6f6ddf2ae223019c52148c5ac76cf70e; https://git.kernel.org/stable/c/1123eadb843588b361c96f53a771202b7953154f; https://git.kernel.org/stable/c/5a0060ddfc1fcfdb0f7b4fa1b7b3b0c436151391
CVE: CVE-2025-68748
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix UAF race between device unplug and FW event processing

The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.

Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().
References: https://git.kernel.org/stable/c/31db188355a49337e3e8ec98b99377e482eab22c; https://git.kernel.org/stable/c/5e3ff56d4cb591daea70786d07dc21d06dc34108; https://git.kernel.org/stable/c/6c1da9ae2c123a9ffda5375e64cc81f9ed3cc04a
CVE: CVE-2025-68749
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Fix race condition when unbinding BOs

Fix 'Memory manager not clean during takedown' warning that occurs
when ivpu_gem_bo_free() removes the BO from the BOs list before it
gets unmapped. Then file_priv_unbind() triggers a warning in
drm_mm_takedown() during context teardown.

Protect the unmapping sequence with bo_list_lock to ensure the BO is
always fully unmapped when removed from the list. This ensures the BO
is either fully unmapped at context teardown time or present on the
list and unmapped by file_priv_unbind().
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/00812636df370bedf4e44a0c81b86ea96bca8628; https://git.kernel.org/stable/c/0328bb097bef05a796217c54b3d651cc3782827c; https://git.kernel.org/stable/c/d71333ffdd3707d84cfb95acfaf8ba892adc066b
CVE: CVE-2025-5448
Published: 2025-12-24
Description: Rejected reason: This CVE id was assigned but later discarded.
CVE: CVE-2025-2154
Published: 2025-12-24
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Stored XSS.This issue affects Specto CM: before 17032025.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0480
CVE: CVE-2025-2155
Published: 2025-12-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion.This issue affects Specto CM: before 17032025.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-25-0480
CVE: CVE-2025-60935
Published: 2025-12-24
Description: An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://gist.github.com/HEXER365/2e866b47d56585e1e59e7c16bf4b4db7; https://github.com/ReturnFI/Blitz
CVE: CVE-2024-35322
Published: 2025-12-24
Description: MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://miguelsantareno.github.io/airc_exploit.txt; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
CVE: CVE-2024-39037
Published: 2025-12-24
Description: MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://miguelsantareno.github.io/airc_exploit.txt; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
CVE: CVE-2024-40317
Published: 2025-12-24
Description: A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter HTTP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://miguelsantareno.github.io/airc_exploit.txt; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
CVE: CVE-2025-43875
Published: 2025-12-24
Description: Under certain circumstances a successful exploitation could result in access to the device.
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-01; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2025-43876
Published: 2025-12-24
Description: Under certain circumstances a successful exploitation could result in access to the device.
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-01; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2025-68750
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: potential integer overflow in usbg_make_tpg()

The variable tpgt in usbg_make_tpg() is defined as unsigned long and is
assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an
integer overflow when tpgt is greater than USHRT_MAX (65535). I
haven't tried to trigger it myself, but it is possible to trigger it
by calling usbg_make_tpg() with a large value for tpgt.

I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the
relevant code accordingly.

This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential
memory corruption").
References: https://git.kernel.org/stable/c/0861b9cb2ff519b7c5a3b1dd52a343e18c4efb24; https://git.kernel.org/stable/c/[PII_REDACTED]4d050f62f8ae25cbb960c17633dc5; https://git.kernel.org/stable/c/358d5ba08f1609c34a054aed88c431844d09705a
CVE: CVE-2025-2515
Published: 2025-12-24
Description: A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (qm) to create or override systemd service unit files that affect the host node. This issue can lead to privilege escalation, unauthorized service execution, and potential system compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://access.redhat.com/security/cve/CVE-2025-2515; https://bugzilla.redhat.com/show_bug.cgi?id=2353313; https://github.com/eclipse-bluechi/bluechi/commit/fe0d28301ce2bd45f0b1d8a98a94efef799fbc73#diff-64140c83db42a8888f346a40de293b80f79ebf7d75ce4137b22567e360bce607
CVE: CVE-2025-36154
Published: 2025-12-24
Description: IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-313
References: https://www.ibm.com/support/pages/node/7255549
CVE: CVE-2018-25127
Published: 2025-12-24
Description: SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that submit forged requests to create admin accounts by tricking logged-in users into visiting a malicious site.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: http://www.socatech.com; https://www.exploit-db.com/exploits/46834; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5520.php
CVE: CVE-2018-25128
Published: 2025-12-24
Description: SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by exploiting injection flaws in Login.php and Card_Edit_GetJson.php.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: http://www.socatech.com; https://www.exploit-db.com/exploits/46833; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5519.php
CVE: CVE-2018-25129
Published: 2025-12-24
Description: SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_ReadSortCard.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: http://www.socatech.com; https://www.exploit-db.com/exploits/46832; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5517.php
CVE: CVE-2018-25130
Published: 2025-12-24
Description: Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credentials stored in an unencrypted database file. Attackers can read the BEWARD.INTERCOM.FDB file to extract usernames and passwords, enabling unauthorized access to IP cameras and door stations.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-256
References: https://www.beward.net; https://www.exploit-db.com/exploits/46267; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5505.php
CVE: CVE-2018-25131
Published: 2025-12-24
Description: Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload functionality. Attackers can upload a malicious HTML file to that executes arbitrary JavaScript in a user's browser session when viewed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/46091; https://www.leica-geosystems.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5503.php
CVE: CVE-2018-25133
Published: 2025-12-24
Description: Synaccess netBooter NP-0801DU 7.4 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages with hidden form submissions to add admin users by tricking authenticated administrators into loading a malicious page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/45894; https://www.synaccess-net.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5501.php
CVE: CVE-2018-25134
Published: 2025-12-24
Description: Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative accounts and gain unauthorized control over power supply management.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/45920; https://www.synaccess-net.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5500.php
CVE: CVE-2018-25135
Published: 2025-12-24
Description: Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-149
References: https://www.anviz.com; https://www.exploit-db.com/exploits/45765; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php
CVE: CVE-2018-25136
Published: 2025-12-24
Description: FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can retrieve video stream images by directly accessing multiple image endpoints like middleImage.jpg, rightimage.jpg, and leftimage.jpg.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.brickstream.com; https://www.exploit-db.com/exploits/45607; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5496.php
CVE: CVE-2018-25137
Published: 2025-12-24
Description: FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download sensitive configuration files. Attackers can exploit the getConfigExportFile.cgi endpoint to retrieve system configurations, potentially enabling authentication bypass and privilege escalation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.brickstream.com; https://www.exploit-db.com/exploits/45599; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5495.php
CVE: CVE-2018-25138
Published: 2025-12-24
Description: FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploit these persistent credentials to gain unauthorized shell access and login to multiple camera interfaces using predefined username and password combinations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.exploit-db.com/exploits/45629; https://www.flir.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5494.php
CVE: CVE-2018-25139
Published: 2025-12-24
Description: FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/45606; https://www.flir.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5492.php
CVE: CVE-2018-25140
Published: 2025-12-24
Description: FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass authentication and authorization controls. Attackers can directly modify device configurations, access system information, and potentially initiate denial of service by sending crafted WebSocket messages without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/45539; https://www.flir.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5490.php
CVE: CVE-2018-25141
Published: 2025-12-24
Description: FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve video streams by accessing specific endpoints like /live.mjpeg, /snapshot.jpg, and RTSP streaming URLs without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/45537; https://www.flir.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5489.php
CVE: CVE-2018-25142
Published: 2025-12-24
Description: NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.exploit-db.com/exploits/45337; https://www.novarad.net; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
CVE: CVE-2018-25143
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. Attackers can exploit a custom 'ping' command in the NcFTP environment to escape the restricted shell and execute commands with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45041; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5486.php
CVE: CVE-2018-25144
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Attackers can exploit unsanitized 'path', 'savefile', 'edit', and 'delfile' parameters to perform unauthorized file system modifications through GET and POST requests.
CVSS Score: 8.4 (HIGH)
CWE: CWE-22
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45037; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php
CVE: CVE-2018-25145
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45036; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.php