Category
Network devices
11,275 known vulnerabilities.
4,487 results · Clear filters · Feed
-
Medium 4.3
Improper input validation in certain NETGEAR routers allows unauthorized modification of protected router functionality
An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions, resulting in unauthoriz…
-
Medium 4.9
Unauthenticated users can disrupt router operation
Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.
-
Medium 4.4
Insufficient input validation vulnerability in NETGEAR JR6150
Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 …
-
Medium 6.9
Insufficient input validation in certain NETGEAR routers
A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.
-
Medium 4.3
Insufficient input validation vulnerability in NETGEAR JR6150 Web UI
Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows administrators connected to the local network to make unauthorized modification of router software and functionality. NETGEAR …
-
Medium 4.8
Netgear Orbi 370 Series Remote Code Execution vulnerability
A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet to run commands on your device when the device administrator performs certain specific management actions. This issue a…
-
Medium 6.0
An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet Fort…
-
Medium 6.2
A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, F…
-
Medium 6.4
Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availa…
-
Medium 5.3
Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect a…
-
Medium 5.0
DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability.
-
Medium 6.6
Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 5.9
Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availabilit…
-
Medium 5.4
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availabil…
-
Medium 5.1
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 5.2
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 4.3
Null pointer dereference vulnerability in the browser module. Impact: Successful exploitation of this vulnerability may…
-
Medium 5.5
Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may …
-
Medium 5.5
Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 4.4
Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 6.3
Permission management vulnerability in the network management module. Impact: Successful exploitation of this vulnerabi…
-
Medium 5.3
D-Link DCS-5615 Boa Webserver boa.conf least privilege violation
A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation. The attack can be …
-
Medium 4.3
D-Link DIR-823G vsftpd vsftpd.conf least privilege violation
A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remo…
-
Medium 6.8
Authenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520WS
An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription …
-
Medium 6.8
Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope…
-
Medium 6.8
Authenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WS
A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containi…
-
Medium 6.8
Authenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WS
A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted O…
-
Medium 5.7
Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profi…
-
Medium 6.0
Arista Edge Threat Management NGFW UI Arbitrary Command Execution
An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal scri…
-
Medium 6.0
Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling b…
-
Medium 6.0
Arista Edge Threat Management NGFW Reports Application Insecure Input Validation
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
-
Medium 6.0
Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not e…
-
Medium 5.9
Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with e…
-
Medium 6.3
D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection
A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The explo…
-
Medium 6.3
D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection
A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remot…
-
Medium 5.8
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward…
KEV Jun 9, 2026 -
Medium 6.5
Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages
CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the …
-
Medium 6.5
Arista EOS SysDB Agent Denial of Service via Malformed CVX Client/Server Messages
In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. T…
-
Medium 6.3
D-Link DWR-M920 formSmsManage sub_41C8E8 command injection
A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action_value results in command injection. The attack is possible to be carried out…
-
Medium 5.9
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.