https://vulnogram.org/ Most recent CVEs assigned by Nozomi Networks Inc. (nozomi). https://vulnogram.org/seaview/icons/nozomi.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-73177 https://vulnogram.org/CVE-2026-73177 Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authe… High Wed, 16 Sep 2026 13:03:44 GMT https://vulnogram.org/CVE-2026-73176 https://vulnogram.org/CVE-2026-73176 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a r… High Wed, 16 Sep 2026 13:03:07 GMT https://vulnogram.org/CVE-2026-73175 https://vulnogram.org/CVE-2026-73175 Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server s… High Wed, 16 Sep 2026 13:02:01 GMT https://vulnogram.org/CVE-2026-73174 https://vulnogram.org/CVE-2026-73174 Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to in… High Wed, 16 Sep 2026 12:59:58 GMT https://vulnogram.org/CVE-2026-73173 https://vulnogram.org/CVE-2026-73173 Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke… High Network Exploitable Wed, 16 Sep 2026 12:58:45 GMT https://vulnogram.org/CVE-2026-73172 https://vulnogram.org/CVE-2026-73172 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows… Critical Network Exploitable Wed, 16 Sep 2026 12:57:44 GMT https://vulnogram.org/CVE-2026-73171 https://vulnogram.org/CVE-2026-73171 Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary fil… High Wed, 16 Sep 2026 12:55:10 GMT https://vulnogram.org/CVE-2026-73170 https://vulnogram.org/CVE-2026-73170 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to… High Wed, 16 Sep 2026 12:53:50 GMT https://vulnogram.org/CVE-2026-73169 https://vulnogram.org/CVE-2026-73169 Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that al… Medium Wed, 16 Sep 2026 12:52:50 GMT https://vulnogram.org/CVE-2026-73167 https://vulnogram.org/CVE-2026-73167 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a r… High Wed, 16 Sep 2026 12:51:11 GMT https://vulnogram.org/CVE-2026-73166 https://vulnogram.org/CVE-2026-73166 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to e… High Wed, 16 Sep 2026 12:50:15 GMT https://vulnogram.org/CVE-2026-73165 https://vulnogram.org/CVE-2026-73165 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a r… High Wed, 16 Sep 2026 12:44:32 GMT https://vulnogram.org/CVE-2026-73164 https://vulnogram.org/CVE-2026-73164 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a r… High Wed, 16 Sep 2026 12:37:25 GMT https://vulnogram.org/CVE-2026-73163 https://vulnogram.org/CVE-2026-73163 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a r… High Wed, 16 Sep 2026 12:36:36 GMT https://vulnogram.org/CVE-2026-19535 https://vulnogram.org/CVE-2026-19535 Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unaut… High Network Exploitable Wed, 16 Sep 2026 12:35:36 GMT https://vulnogram.org/CVE-2026-33920 https://vulnogram.org/CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with t… Medium Tue, 08 Sep 2026 13:57:54 GMT https://vulnogram.org/CVE-2026-33391 https://vulnogram.org/CVE-2026-33391 An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the we… Medium Tue, 08 Sep 2026 13:56:38 GMT https://vulnogram.org/CVE-2026-33389 https://vulnogram.org/CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable… High Network Exploitable Tue, 08 Sep 2026 13:55:16 GMT https://vulnogram.org/CVE-2026-33388 https://vulnogram.org/CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the C… High Tue, 08 Sep 2026 13:53:16 GMT https://vulnogram.org/CVE-2026-33387 https://vulnogram.org/CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim… Medium Tue, 08 Sep 2026 13:50:31 GMT https://vulnogram.org/CVE-2026-57472 https://vulnogram.org/CVE-2026-57472 Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 th… Medium Fri, 14 Aug 2026 15:04:47 GMT https://vulnogram.org/CVE-2026-57471 https://vulnogram.org/CVE-2026-57471 Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 th… Medium Fri, 14 Aug 2026 15:04:16 GMT https://vulnogram.org/CVE-2026-57469 https://vulnogram.org/CVE-2026-57469 Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations i… Medium Network Exploitable Fri, 14 Aug 2026 15:03:32 GMT https://vulnogram.org/CVE-2026-13198 https://vulnogram.org/CVE-2026-13198 Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local auth… Medium Fri, 14 Aug 2026 15:02:42 GMT https://vulnogram.org/CVE-2026-13197 https://vulnogram.org/CVE-2026-13197 Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2… High Fri, 14 Aug 2026 15:01:39 GMT https://vulnogram.org/CVE-2026-13196 https://vulnogram.org/CVE-2026-13196 Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attac… High Fri, 14 Aug 2026 15:00:48 GMT https://vulnogram.org/CVE-2026-33922 https://vulnogram.org/CVE-2026-33922 A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an ar… Medium Tue, 11 Aug 2026 09:48:35 GMT https://vulnogram.org/CVE-2026-33921 https://vulnogram.org/CVE-2026-33921 The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administra… Medium Tue, 11 Aug 2026 09:48:20 GMT https://vulnogram.org/CVE-2026-33390 https://vulnogram.org/CVE-2026-33390 An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, alt… High Thu, 09 Jul 2026 07:23:30 GMT https://vulnogram.org/CVE-2026-31985 https://vulnogram.org/CVE-2026-31985 When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the-middle att… High Network Exploitable Thu, 09 Jul 2026 07:23:06 GMT https://vulnogram.org/CVE-2026-31984 https://vulnogram.org/CVE-2026-31984 A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing… High Network Exploitable Thu, 09 Jul 2026 07:22:53 GMT https://vulnogram.org/CVE-2026-31983 https://vulnogram.org/CVE-2026-31983 A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH k… Medium Network Exploitable Thu, 09 Jul 2026 07:22:44 GMT https://vulnogram.org/CVE-2026-31982 https://vulnogram.org/CVE-2026-31982 An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison… High Network Exploitable Thu, 09 Jul 2026 07:22:35 GMT https://vulnogram.org/CVE-2026-31981 https://vulnogram.org/CVE-2026-31981 A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags int… Medium Thu, 09 Jul 2026 07:22:21 GMT https://vulnogram.org/CVE-2026-13199 https://vulnogram.org/CVE-2026-13199 EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additi… Medium Tue, 07 Jul 2026 08:36:57 GMT https://vulnogram.org/CVE-2026-57473 https://vulnogram.org/CVE-2026-57473 A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to int… Medium Fri, 26 Jun 2026 10:47:31 GMT https://vulnogram.org/CVE-2025-41281 https://vulnogram.org/CVE-2025-41281 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execut… High Fri, 29 May 2026 11:00:16 GMT https://vulnogram.org/CVE-2025-41280 https://vulnogram.org/CVE-2025-41280 Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configur… High Fri, 29 May 2026 10:59:40 GMT https://vulnogram.org/CVE-2025-41279 https://vulnogram.org/CVE-2025-41279 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticat… High Fri, 29 May 2026 10:59:10 GMT https://vulnogram.org/CVE-2025-41278 https://vulnogram.org/CVE-2025-41278 Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attackers with access to the TX Host to execute code on the RX Host. High Fri, 29 May 2026 10:58:37 GMT https://vulnogram.org/CVE-2025-41277 https://vulnogram.org/CVE-2025-41277 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:57:59 GMT https://vulnogram.org/CVE-2025-41276 https://vulnogram.org/CVE-2025-41276 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:57:22 GMT https://vulnogram.org/CVE-2025-41275 https://vulnogram.org/CVE-2025-41275 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:56:28 GMT https://vulnogram.org/CVE-2025-41274 https://vulnogram.org/CVE-2025-41274 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:53:38 GMT https://vulnogram.org/CVE-2025-41273 https://vulnogram.org/CVE-2025-41273 Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authent… Critical Network Exploitable Fri, 29 May 2026 10:53:02 GMT https://vulnogram.org/CVE-2025-41272 https://vulnogram.org/CVE-2025-41272 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:52:21 GMT https://vulnogram.org/CVE-2025-41271 https://vulnogram.org/CVE-2025-41271 Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device. High Network Exploitable Fri, 29 May 2026 10:51:40 GMT https://vulnogram.org/CVE-2025-41270 https://vulnogram.org/CVE-2025-41270 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:51:03 GMT https://vulnogram.org/CVE-2025-41269 https://vulnogram.org/CVE-2025-41269 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenti… Critical Network Exploitable Fri, 29 May 2026 10:50:06 GMT https://vulnogram.org/CVE-2025-41268 https://vulnogram.org/CVE-2025-41268 Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete arbitrary files on the Host machin… High Network Exploitable Fri, 29 May 2026 10:49:29 GMT