https://vulnogram.org/ Most recent CVEs assigned by CyberDanube (cyberdanube). https://vulnogram.org/seaview/icons/cyberdanube.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2025-15683 https://vulnogram.org/CVE-2025-15683 TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or termi… High Network Exploitable Mon, 10 Aug 2026 19:38:57 GMT https://vulnogram.org/CVE-2025-15682 https://vulnogram.org/CVE-2025-15682 TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containin… High Network Exploitable Mon, 10 Aug 2026 19:33:23 GMT https://vulnogram.org/CVE-2025-15681 https://vulnogram.org/CVE-2025-15681 TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint withou… Critical Network Exploitable Mon, 10 Aug 2026 19:31:05 GMT https://vulnogram.org/CVE-2025-15680 https://vulnogram.org/CVE-2025-15680 TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The di… Low Mon, 10 Aug 2026 19:27:28 GMT https://vulnogram.org/CVE-2025-13294 https://vulnogram.org/CVE-2025-13294 An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterizatio… Critical Network Exploitable Mon, 10 Aug 2026 19:25:32 GMT https://vulnogram.org/CVE-2025-13293 https://vulnogram.org/CVE-2025-13293 A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password has… Critical Network Exploitable Mon, 10 Aug 2026 19:24:10 GMT https://vulnogram.org/CVE-2026-65313 https://vulnogram.org/CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-… High Fri, 31 Jul 2026 07:34:11 GMT https://vulnogram.org/CVE-2026-65311 https://vulnogram.org/CVE-2026-65311 The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with ne… Medium Network Exploitable Fri, 31 Jul 2026 07:30:07 GMT https://vulnogram.org/CVE-2026-65310 https://vulnogram.org/CVE-2026-65310 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access… High Network Exploitable Fri, 31 Jul 2026 07:26:29 GMT https://vulnogram.org/CVE-2026-65309 https://vulnogram.org/CVE-2026-65309 ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to rec… High Network Exploitable Fri, 31 Jul 2026 07:17:40 GMT https://vulnogram.org/CVE-2026-8989 https://vulnogram.org/CVE-2026-8989 Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract… High Tue, 21 Jul 2026 21:24:28 GMT https://vulnogram.org/CVE-2026-8988 https://vulnogram.org/CVE-2026-8988 Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file sys… High Tue, 21 Jul 2026 21:21:50 GMT https://vulnogram.org/CVE-2026-8987 https://vulnogram.org/CVE-2026-8987 Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentia… Critical Tue, 21 Jul 2026 21:18:32 GMT https://vulnogram.org/CVE-2026-8986 https://vulnogram.org/CVE-2026-8986 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command exec… Critical Network Exploitable Tue, 21 Jul 2026 21:14:26 GMT https://vulnogram.org/CVE-2026-8985 https://vulnogram.org/CVE-2026-8985 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system… Critical Network Exploitable Tue, 21 Jul 2026 21:11:25 GMT https://vulnogram.org/CVE-2026-8984 https://vulnogram.org/CVE-2026-8984 Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-contr… Critical Network Exploitable Tue, 21 Jul 2026 21:08:49 GMT https://vulnogram.org/CVE-2026-8983 https://vulnogram.org/CVE-2026-8983 Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality wit… Critical Network Exploitable Tue, 21 Jul 2026 21:03:22 GMT https://vulnogram.org/CVE-2026-8982 https://vulnogram.org/CVE-2026-8982 Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm an… Critical Network Exploitable Tue, 21 Jul 2026 21:01:02 GMT https://vulnogram.org/CVE-2026-8980 https://vulnogram.org/CVE-2026-8980 The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-privileged user can change the passwords of the admin (operator) and manufacturer accounts via crafted POST requests. Critical Network Exploitable Thu, 28 May 2026 13:12:34 GMT https://vulnogram.org/CVE-2026-8979 https://vulnogram.org/CVE-2026-8979 The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. An unauthenticated remote attacker can change the password of the user account via a crafted POST request to the /operator/operator endpoint. Critical Network Exploitable Thu, 28 May 2026 13:05:40 GMT https://vulnogram.org/CVE-2025-9966 https://vulnogram.org/CVE-2025-9966 Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). High Tue, 23 Sep 2025 11:41:19 GMT https://vulnogram.org/CVE-2025-9965 https://vulnogram.org/CVE-2025-9965 Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). Critical Network Exploitable Tue, 23 Sep 2025 11:36:35 GMT https://vulnogram.org/CVE-2025-9964 https://vulnogram.org/CVE-2025-9964 No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). High Tue, 23 Sep 2025 11:33:13 GMT https://vulnogram.org/CVE-2025-9963 https://vulnogram.org/CVE-2025-9963 A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. This way the system can also be compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build… Critical Tue, 23 Sep 2025 11:11:14 GMT https://vulnogram.org/CVE-2025-9962 https://vulnogram.org/CVE-2025-9962 A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). Critical Network Exploitable Tue, 23 Sep 2025 11:02:13 GMT https://vulnogram.org/CVE-2024-9154 https://vulnogram.org/CVE-2024-9154 A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 (#2633). High Thu, 19 Dec 2024 15:59:53 GMT https://vulnogram.org/CVE-2024-55548 https://vulnogram.org/CVE-2024-55548 Improper check of password character lenght in ORing IAP-420 allows a forced deadlock. This issue affects IAP-420: through 2.01e. Medium Tue, 10 Dec 2024 16:34:02 GMT https://vulnogram.org/CVE-2024-55547 https://vulnogram.org/CVE-2024-55547 SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e. Critical Network Exploitable Tue, 10 Dec 2024 16:27:07 GMT https://vulnogram.org/CVE-2024-55546 https://vulnogram.org/CVE-2024-55546 Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. High Network Exploitable Tue, 10 Dec 2024 16:21:33 GMT https://vulnogram.org/CVE-2024-55545 https://vulnogram.org/CVE-2024-55545 Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. High Network Exploitable Tue, 10 Dec 2024 16:14:17 GMT https://vulnogram.org/CVE-2024-55544 https://vulnogram.org/CVE-2024-55544 Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below. High Tue, 10 Dec 2024 16:04:34 GMT https://vulnogram.org/CVE-2024-11304 https://vulnogram.org/CVE-2024-11304 Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS). This issue affects utnserver Pro, utnserver ProMAX, INU-100 v… Medium Mon, 18 Nov 2024 14:26:08 GMT https://vulnogram.org/CVE-2024-11303 https://vulnogram.org/CVE-2024-11303 The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2. High Network Exploitable Mon, 18 Nov 2024 13:24:37 GMT https://vulnogram.org/CVE-2024-8877 https://vulnogram.org/CVE-2024-8877 Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204. It is only limited to the SQLite database of measurement data.This issue affects Netman 204: through 4.05. Medium Network Exploitable Tue, 24 Sep 2024 15:19:31 GMT https://vulnogram.org/CVE-2024-8878 https://vulnogram.org/CVE-2024-8878 The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05. Critical Network Exploitable Tue, 24 Sep 2024 15:14:31 GMT https://vulnogram.org/CVE-2024-42167 https://vulnogram.org/CVE-2024-42167 The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute… Critical Mon, 12 Aug 2024 11:38:35 GMT https://vulnogram.org/CVE-2024-42166 https://vulnogram.org/CVE-2024-42166 The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute com… Critical Mon, 12 Aug 2024 11:36:28 GMT https://vulnogram.org/CVE-2024-42165 https://vulnogram.org/CVE-2024-42165 Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link. Medium Mon, 12 Aug 2024 11:33:39 GMT https://vulnogram.org/CVE-2024-42164 https://vulnogram.org/CVE-2024-42164 Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link. Medium Mon, 12 Aug 2024 11:27:17 GMT https://vulnogram.org/CVE-2024-42163 https://vulnogram.org/CVE-2024-42163 Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link. High Mon, 12 Aug 2024 11:21:54 GMT https://vulnogram.org/CVE-2024-7397 https://vulnogram.org/CVE-2024-7397 Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: through 1.2. Critical Network Exploitable Mon, 05 Aug 2024 13:25:43 GMT https://vulnogram.org/CVE-2024-7396 https://vulnogram.org/CVE-2024-7396 Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2. High Network Exploitable Mon, 05 Aug 2024 13:20:57 GMT https://vulnogram.org/CVE-2024-7395 https://vulnogram.org/CVE-2024-7395 An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issue affects JetPort 5601v3: through 1.2. Critical Network Exploitable Mon, 05 Aug 2024 13:16:05 GMT https://vulnogram.org/CVE-2024-6913 https://vulnogram.org/CVE-2024-6913 Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0. Critical Network Exploitable Mon, 22 Jul 2024 21:00:08 GMT https://vulnogram.org/CVE-2024-6912 https://vulnogram.org/CVE-2024-6912 Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects ProcessPlus: through 1.11.6507.0. Critical Network Exploitable Mon, 22 Jul 2024 20:51:15 GMT https://vulnogram.org/CVE-2024-6911 https://vulnogram.org/CVE-2024-6911 Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0. High Network Exploitable Mon, 22 Jul 2024 20:44:30 GMT https://vulnogram.org/CVE-2024-5422 https://vulnogram.org/CVE-2024-5422 An uncontrolled resource consumption of file descriptors in SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 allows DoS via HTTP.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 2… High Tue, 04 Jun 2024 08:06:45 GMT https://vulnogram.org/CVE-2024-5421 https://vulnogram.org/CVE-2024-5421 Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and belo… High Tue, 04 Jun 2024 07:58:50 GMT https://vulnogram.org/CVE-2024-5420 https://vulnogram.org/CVE-2024-5420 Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS)..This issue affects utnserver Pro, utnserver ProMAX, INU-100 v… High Network Exploitable Tue, 04 Jun 2024 07:48:27 GMT https://vulnogram.org/CVE-2024-5411 https://vulnogram.org/CVE-2024-5411 Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects IAP-420 version 2.01e and below. High Tue, 28 May 2024 10:28:51 GMT