-
ZDI-CAN-25862: Ashlar-Vellum
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Rocco Calvi (@TecR0c) with TecSecurity’ was reported to the affected vendor on: 2024-12-19, 16 days ago. The vendor is given until 2025-04-18 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.…
-
ZDI-CAN-25710: Fortinet
A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Alexander Staalgaard’ was reported to the affected vendor on: 2024-12-19, 16 days ago. The vendor is given until 2025-04-18 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory. A CVSS score…
-
ZDI-CAN-25944: Ashlar-Vellum
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Rocco Calvi (@TecR0c) with TecSecurity’ was reported to the affected vendor on: 2024-12-19, 16 days ago. The vendor is given until 2025-04-18 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.…
-
ZDI-CAN-25943: Ashlar-Vellum
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Rocco Calvi (@TecR0c) with TecSecurity’ was reported to the affected vendor on: 2024-12-19, 16 days ago. The vendor is given until 2025-04-18 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.…
-
ZDI-CAN-25989: Autodesk
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Rocco Calvi (@TecR0c) with TecSecurity’ was reported to the affected vendor on: 2024-12-18, 17 days ago. The vendor is given until 2025-04-17 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.…
-
ZDI-CAN-25952: Autodesk
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Rocco Calvi (@TecR0c) with TecSecurity’ was reported to the affected vendor on: 2024-12-18, 17 days ago. The vendor is given until 2025-04-17 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.…
-
ZDI-CAN-25951: Autodesk
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Rocco Calvi (@TecR0c) with TecSecurity’ was reported to the affected vendor on: 2024-12-18, 17 days ago. The vendor is given until 2025-04-17 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.…
-
ZDI-CAN-25788: Oracle
A CVSS score 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘Emad Al-Mousa’ was reported to the affected vendor on: 2024-12-18, 17 days ago. The vendor is given until 2025-04-17 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory. A CVSS score…
-
ZDI-CAN-25849: Lexmark
A CVSS score 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by ‘nella17 (@nella17tw), working with DEVCORE Internship Program, and DEVCORE Research Team’ was reported to the affected vendor on: 2024-12-18, 17 days ago. The vendor is given until 2025-04-17 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate…
-
We discovered several vulnerabilities in the Milesight UG67 Outdoor LoRaWAN Gateway. The device had an unprotected USB console allowing access to the root file-system for analysis, an undocumented default password usable for remote SSH login, a command execution circumventing the restricted shell and a local privilege escalation using ubus as well as a local privilege escalation using world-writeable webroot. The issues can be combined to allow privileged access from a remote connection.
We discovered several vulnerabilities in the Milesight UG67 Outdoor LoRaWAN Gateway. The device had an unprotected USB console allowing access to the root file-system for analysis, an undocumented default password usable for remote SSH login, a command execution circumventing the restricted shell and a local privilege escalation using ubus as well as a local privilege…