https://vulnogram.org/ Most recent CVEs assigned by National Cyber Security Centre Netherlands (NCSC-NL) (ncsc-nl). https://vulnogram.org/seaview/icons/ncsc-nl.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-103316 https://vulnogram.org/CVE-2026-103316 The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the m… High Tue, 13 Oct 2026 06:06:57 GMT https://vulnogram.org/CVE-2025-59819 https://vulnogram.org/CVE-2025-59819 This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path. Medium Fri, 20 Feb 2026 07:58:57 GMT https://vulnogram.org/CVE-2025-59818 https://vulnogram.org/CVE-2025-59818 This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file. Critical Network Exploitable Wed, 04 Feb 2026 10:26:53 GMT https://vulnogram.org/CVE-2025-64093 https://vulnogram.org/CVE-2025-64093 Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device. Critical Network Exploitable Fri, 09 Jan 2026 10:04:58 GMT https://vulnogram.org/CVE-2025-64092 https://vulnogram.org/CVE-2025-64092 This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database. High Network Exploitable Fri, 09 Jan 2026 10:03:49 GMT https://vulnogram.org/CVE-2025-64091 https://vulnogram.org/CVE-2025-64091 This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device. High Network Exploitable Fri, 09 Jan 2026 10:00:45 GMT https://vulnogram.org/CVE-2025-64090 https://vulnogram.org/CVE-2025-64090 This vulnerability allows authenticated attackers to execute commands via the hostname of the device. Critical Network Exploitable Fri, 09 Jan 2026 09:59:58 GMT https://vulnogram.org/CVE-2025-11690 https://vulnogram.org/CVE-2025-11690 An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordin… High Tue, 04 Nov 2025 10:25:45 GMT https://vulnogram.org/CVE-2025-59817 https://vulnogram.org/CVE-2025-59817 This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, conf… High Thu, 25 Sep 2025 19:30:15 GMT https://vulnogram.org/CVE-2025-59816 https://vulnogram.org/CVE-2025-59816 This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the seve… High Thu, 25 Sep 2025 19:30:03 GMT https://vulnogram.org/CVE-2025-59815 https://vulnogram.org/CVE-2025-59815 This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity. High Thu, 25 Sep 2025 19:29:50 GMT https://vulnogram.org/CVE-2025-59814 https://vulnogram.org/CVE-2025-59814 This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database. High Thu, 25 Sep 2025 19:29:34 GMT https://vulnogram.org/CVE-2023-41928 https://vulnogram.org/CVE-2023-41928 The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. Medium Tue, 02 Jul 2024 07:43:31 GMT https://vulnogram.org/CVE-2023-41927 https://vulnogram.org/CVE-2023-41927 The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. Medium Tue, 02 Jul 2024 07:43:25 GMT https://vulnogram.org/CVE-2023-41926 https://vulnogram.org/CVE-2023-41926 The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials. High Network Exploitable Tue, 02 Jul 2024 07:43:16 GMT https://vulnogram.org/CVE-2023-41923 https://vulnogram.org/CVE-2023-41923 The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. High Network Exploitable Tue, 02 Jul 2024 07:42:49 GMT https://vulnogram.org/CVE-2023-41922 https://vulnogram.org/CVE-2023-41922 A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interfac… High Network Exploitable Tue, 02 Jul 2024 07:42:42 GMT https://vulnogram.org/CVE-2023-41921 https://vulnogram.org/CVE-2023-41921 A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware b… Critical Network Exploitable Tue, 02 Jul 2024 07:42:33 GMT https://vulnogram.org/CVE-2023-41920 https://vulnogram.org/CVE-2023-41920 The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in. Critical Network Exploitable Tue, 02 Jul 2024 07:42:24 GMT https://vulnogram.org/CVE-2023-41919 https://vulnogram.org/CVE-2023-41919 Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. Critical Network Exploitable Tue, 02 Jul 2024 07:42:16 GMT https://vulnogram.org/CVE-2023-41918 https://vulnogram.org/CVE-2023-41918 A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or eve… Critical Network Exploitable Tue, 02 Jul 2024 07:42:08 GMT https://vulnogram.org/CVE-2023-41917 https://vulnogram.org/CVE-2023-41917 Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution. Critical Network Exploitable Tue, 02 Jul 2024 07:41:28 GMT https://vulnogram.org/CVE-2023-43870 https://vulnogram.org/CVE-2023-43870 When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root cer… High Network Exploitable Tue, 19 Dec 2023 15:09:13 GMT https://vulnogram.org/CVE-2022-24403 https://vulnogram.org/CVE-2022-24403 The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary… Medium Tue, 05 Dec 2023 13:54:32 GMT https://vulnogram.org/CVE-2022-25332 https://vulnogram.org/CVE-2022-25332 The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collectin… Medium Thu, 19 Oct 2023 09:36:24 GMT https://vulnogram.org/CVE-2022-25334 https://vulnogram.org/CVE-2022-25334 The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) lacks a bounds check on the signature size field in the SK_LOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field caus… High Thu, 19 Oct 2023 09:36:09 GMT https://vulnogram.org/CVE-2022-26941 https://vulnogram.org/CVE-2022-26941 A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obta… Critical Thu, 19 Oct 2023 09:35:52 GMT https://vulnogram.org/CVE-2022-26942 https://vulnogram.org/CVE-2022-26942 The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In bot… High Thu, 19 Oct 2023 09:35:24 GMT https://vulnogram.org/CVE-2022-25333 https://vulnogram.org/CVE-2022-25333 The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adver… High Thu, 19 Oct 2023 09:35:03 GMT https://vulnogram.org/CVE-2022-27813 https://vulnogram.org/CVE-2022-27813 Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Si… High Thu, 19 Oct 2023 09:34:44 GMT https://vulnogram.org/CVE-2022-26943 https://vulnogram.org/CVE-2022-26943 The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerabl… High Thu, 19 Oct 2023 09:34:20 GMT https://vulnogram.org/CVE-2022-24400 https://vulnogram.org/CVE-2022-24400 A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero. High Thu, 19 Oct 2023 09:33:28 GMT https://vulnogram.org/CVE-2022-24401 https://vulnogram.org/CVE-2022-24401 Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner.… High Thu, 19 Oct 2023 09:32:53 GMT https://vulnogram.org/CVE-2022-24402 https://vulnogram.org/CVE-2022-24402 The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks. High Thu, 19 Oct 2023 09:32:23 GMT https://vulnogram.org/CVE-2022-24404 https://vulnogram.org/CVE-2022-24404 Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion. Medium Thu, 19 Oct 2023 09:31:43 GMT https://vulnogram.org/CVE-2023-23774 https://vulnogram.org/CVE-2023-23774 Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's serial port in case of an unhandled exception. This allows an attacker with physical access that… High Tue, 29 Aug 2023 08:49:32 GMT https://vulnogram.org/CVE-2023-23773 https://vulnogram.org/CVE-2023-23773 Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secre… High Tue, 29 Aug 2023 08:49:00 GMT https://vulnogram.org/CVE-2023-23772 https://vulnogram.org/CVE-2023-23772 Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, e… High Tue, 29 Aug 2023 08:48:45 GMT https://vulnogram.org/CVE-2023-23771 https://vulnogram.org/CVE-2023-23771 Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be chan… High Tue, 29 Aug 2023 08:48:26 GMT https://vulnogram.org/CVE-2023-23770 https://vulnogram.org/CVE-2023-23770 Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cann… Critical Network Exploitable Tue, 29 Aug 2023 08:47:13 GMT