ByteOS

>>sonicos>>Versions from 5.9.0.0(inclusive) to 5.9.0.7(inclusive)

>>sonicos>>Versions from 5.9.1.0.(inclusive) to 5.9.1.12(inclusive)

>>sonicos>>Versions from 6.2.0.0(inclusive) to 6.2.3.1(inclusive)

>>sonicos>>Versions from 6.2.4.0(inclusive) to 6.2.4.3(inclusive)

>>sonicos>>Versions from 6.2.5.0(inclusive) to 6.2.5.3(inclusive)

>>sonicos>>Versions from 6.2.6.0(inclusive) to 6.2.6.1(inclusive)

>>sonicos>>Versions from 6.2.7.0(inclusive) to 6.2.7.4(inclusive)

>>sonicos>>Versions from 6.2.9.0(inclusive) to 6.2.9.2(inclusive)

>>sonicos>>Versions from 6.5.0.0(inclusive) to 6.5.0.3(inclusive)

>>sonicos>>Versions from 6.5.1.0(inclusive) to 6.5.1.4(inclusive)

>>sonicos>>Versions from 6.5.2.0(inclusive) to 6.5.2.3(inclusive)

>>sonicos>>Versions from 6.5.3.0(inclusive) to 6.5.3.3(inclusive)

>>sonicos>>Versions from 6.5.4.0.(inclusive) to 6.5.4.3(inclusive)

cpe:2.3:o:sonicwall:sonicos:6.2.7.0:*:*:*:*:*:*:*

>>sonicos>>6.2.7.0

cpe:2.3:o:sonicwall:sonicos:6.2.7.1:*:*:*:*:*:*:*

>>sonicos>>6.2.7.1

cpe:2.3:o:sonicwall:sonicos:6.2.7.7:*:*:*:*:*:*:*

>>sonicos>>6.2.7.7

cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300

>>siprotec_5_firmware>>Versions before 7.91(exclusive)

cpe:2.3:h:siemens:siprotec_5:-:*:*:*:*:*:*:*

>>siprotec_5>>-

cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp200

>>siprotec_5_firmware>>*

cpe:2.3:o:siemens:siprotec_5:-:*:*:*:*:*:*:*

>>siprotec_5>>-

cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300

>>siprotec_5_firmware>>*

cpe:2.3:o:siemens:siprotec_5:-:*:*:*:*:*:*:*

>>siprotec_5>>-

cpe:2.3:o:siemens:power_meter_9410_firmware:*:*:*:*:*:*:*:*

>>power_meter_9410_firmware>>Versions before 2.2.1(exclusive)

cpe:2.3:h:siemens:power_meter_9410:-:*:*:*:*:*:*:*

>>power_meter_9410>>-

cpe:2.3:o:siemens:power_meter_9810_firmware:*:*:*:*:*:*:*:*

>>power_meter_9810_firmware>>*

cpe:2.3:h:siemens:power_meter_9810:-:*:*:*:*:*:*:*

>>power_meter_9810>>-

cpe:2.3:o:siemens:ruggedcom_win7000_firmware:*:*:*:*:*:*:*:*

>>ruggedcom_win7000_firmware>>Versions before bs5.2.461.17(exclusive)

cpe:2.3:h:siemens:ruggedcom_win7000:-:*:*:*:*:*:*:*

>>ruggedcom_win7000>>-

cpe:2.3:o:siemens:ruggedcom_win7018_firmware:*:*:*:*:*:*:*:*

>>ruggedcom_win7018_firmware>>Versions before bs5.2.461.17(exclusive)

cpe:2.3:h:siemens:ruggedcom_win7018:-:*:*:*:*:*:*:*

>>ruggedcom_win7018>>-

cpe:2.3:o:siemens:ruggedcom_win7025_firmware:*:*:*:*:*:*:*:*

>>ruggedcom_win7025_firmware>>Versions before bs5.2.461.17(exclusive)

cpe:2.3:h:siemens:ruggedcom_win7025:-:*:*:*:*:*:*:*

>>ruggedcom_win7025>>-

cpe:2.3:o:siemens:ruggedcom_win7200_firmware:*:*:*:*:*:*:*:*

>>ruggedcom_win7200_firmware>>Versions before bs5.2.461.17(exclusive)

cpe:2.3:h:siemens:ruggedcom_win7200:-:*:*:*:*:*:*:*

>>ruggedcom_win7200>>-

belden>>hirschmann_hios>>Versions up to 07.0.07(inclusive)

cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*

belden>>hirschmann_ees20>>-

cpe:2.3:h:belden:hirschmann_ees20:-:*:*:*:*:*:*:*

belden>>hirschmann_ees25>>-

cpe:2.3:h:belden:hirschmann_ees25:-:*:*:*:*:*:*:*

belden>>hirschmann_eesx20>>-

cpe:2.3:h:belden:hirschmann_eesx20:-:*:*:*:*:*:*:*

belden>>hirschmann_eesx30>>-

cpe:2.3:h:belden:hirschmann_eesx30:-:*:*:*:*:*:*:*

belden>>hirschmann_grs1020>>-

cpe:2.3:h:belden:hirschmann_grs1020:-:*:*:*:*:*:*:*

belden>>hirschmann_grs1030>>-

cpe:2.3:h:belden:hirschmann_grs1030:-:*:*:*:*:*:*:*

belden>>hirschmann_grs1042>>-

cpe:2.3:h:belden:hirschmann_grs1042:-:*:*:*:*:*:*:*

belden>>hirschmann_grs1120>>-

cpe:2.3:h:belden:hirschmann_grs1120:-:*:*:*:*:*:*:*

belden>>hirschmann_grs1130>>-

cpe:2.3:h:belden:hirschmann_grs1130:-:*:*:*:*:*:*:*

belden>>hirschmann_grs1142>>-

cpe:2.3:h:belden:hirschmann_grs1142:-:*:*:*:*:*:*:*

belden>>hirschmann_msp30>>-

cpe:2.3:h:belden:hirschmann_msp30:-:*:*:*:*:*:*:*

belden>>hirschmann_msp32>>-

cpe:2.3:h:belden:hirschmann_msp32:-:*:*:*:*:*:*:*

belden>>hirschmann_rail_switch_power_lite>>-

cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-120	Primary	nvd@nist.gov

CWE ID: CWE-120

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf	cve@mitre.org	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf	cve@mitre.org	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf	cve@mitre.org	Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009	cve@mitre.org	Third Party Advisory
https://security.netapp.com/advisory/ntap-20190802-0001/	cve@mitre.org	Third Party Advisory
https://support.f5.com/csp/article/K41190253	cve@mitre.org	Third Party Advisory
https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS	cve@mitre.org	N/A
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255	cve@mitre.org	Vendor Advisory
https://support2.windriver.com/index.php?page=security-notices	cve@mitre.org	Issue Tracking Vendor Advisory
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/	cve@mitre.org	Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20190802-0001/

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://support.f5.com/csp/article/K41190253

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://support2.windriver.com/index.php?page=security-notices

Source: cve@mitre.org

Resource:

Issue Tracking

Vendor Advisory

Hyperlink: https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/

Source: cve@mitre.org

Resource:

Vendor Advisory

Similar CVEs

1427Records found

CVE-2024-22039

Matching Score-10

Assigner-Siemens

Matching Score-10

Assigner-Siemens

CVSS Score-10||CRITICAL

EPSS-8.46% / 91.98%

7 Day CHG~0.00%

Published-12 Mar, 2024 | 10:21

Updated-01 Aug, 2024 | 22:35

A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO EN Fire Panel FC72x IP7 (All versions < IP7 SR5), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions < V3.0.6602), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.0.5016), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions < V3.2.6601), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.2.5015), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions < MP8), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions < MP6 SR3), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions < MP7 SR5), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions < V3.0.6602), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.2.5015), Sinteso Mobile (All versions < V3.0.0). The network communication library in affected systems does not validate the length of certain X.509 certificate attributes which might result in a stack-based buffer overflow. This could allow an unauthenticated remote attacker to execute code on the underlying operating system with root privileges.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-3711

Matching Score-10

Assigner-OpenSSL Software Foundation

Matching Score-10

Assigner-OpenSSL Software Foundation

CVSS Score-9.8||CRITICAL

EPSS-2.75% / 85.41%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 14:50

Updated-16 Sep, 2024 | 18:29

SM2 Decryption Buffer Overflow

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

Vendor-Debian GNU/Linux OpenSSL NetApp, Inc.Oracle Corporation Tenable, Inc.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-37726

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.32% / 79.03%

7 Day CHG~0.00%

Published-12 Oct, 2021 | 14:06

Updated-04 Aug, 2024 | 01:23

A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.

Product-aruba_instant scalance_w1750d_firmware scalance_w1750d HPE Aruba Instant (IAP)

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-37716

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.58% / 80.84%

7 Day CHG~0.00%

Published-07 Sep, 2021 | 12:02

Updated-04 Aug, 2024 | 01:23

A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Product-arubaos sd-wan scalance_w1750d_firmware scalance_w1750d Aruba SD-WAN Software and Gateways; Aruba Operating System Software

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2015-7853

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-20.96% / 95.42%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.

Vendor-ntp n/a NetApp, Inc.

Product-oncommand_unified_manager oncommand_performance_manager oncommand_balance clustered_data_ontap ntp data_ontap n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-33719

Matching Score-10

Assigner-Siemens

Product-siprotec_5_with_cpu_variant_cp300 siprotec_5_with_cpu_variant_cp100 siprotec_5_with_cpu_variant_cp050 SIPROTEC 5 relays with CPU variants CP050 SIPROTEC 5 relays with CPU variants CP300 SIPROTEC 5 relays with CPU variants CP100

Matching Score-10

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.56% / 67.11%

7 Day CHG~0.00%

Published-14 Sep, 2021 | 10:47

Updated-03 Aug, 2024 | 23:58

A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Specially crafted packets sent to port 4443/tcp could cause a Denial-of-Service condition or potential remote code execution.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-27391

Matching Score-10

Assigner-Siemens

Matching Score-10

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-2.86% / 85.72%

7 Day CHG~0.00%

Published-14 Sep, 2021 | 10:47

Updated-23 Apr, 2025 | 19:28

A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-25149

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-0.71% / 71.42%

7 Day CHG~0.00%

Published-29 Mar, 2021 | 23:58

Updated-03 Aug, 2024 | 19:56

A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

Product-scalance_w1750d_firmware instant scalance_w1750d Aruba Instant Access Points

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-11984

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-80.22% / 99.08%

7 Day CHG-2.00%

Published-07 Aug, 2020 | 15:27

Updated-04 Aug, 2024 | 11:48

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-20045

Matching Score-10

Assigner-SonicWall, Inc.

Matching Score-10

Assigner-SonicWall, Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.93% / 85.88%

7 Day CHG~0.00%

Published-08 Dec, 2021 | 09:55

Updated-03 Aug, 2024 | 17:30

A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Vendor-SonicWall Inc.

Product-sma_410_firmware sma_210 sma_410 sma_400_firmware sma_210_firmware sma_500v_firmware sma_500v sma_200_firmware sma_200 sma_400 SonicWall SMA100

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37890

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-0.82% / 73.45%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.

Product-arubaos scalance_w1750d_firmware instant scalance_w1750d Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37887

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 78.89%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37889

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 78.89%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37886

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 78.89%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-36361

Matching Score-10

Assigner-Siemens

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-10

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.68%

7 Day CHG~0.00%

Published-11 Oct, 2022 | 00:00

Updated-20 Nov, 2024 | 14:54

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). Affected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-6994

Matching Score-10

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-0.05% / 15.82%

7 Day CHG~0.00%

Published-03 Apr, 2020 | 18:04

Updated-04 Aug, 2024 | 09:18

A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.

Vendor-belden Hirschmann Automation and Control GmbH, a division of Belden Inc.

Product-hirschmann_rail_switch_power_lite hirschmann_eagle20 hirschmann_prp_redbox hirschmann_eagle30 hirschmann_hisecos hirschmann_embedded_ethernet_switch_extended hirschmann_hios hirschmann_embedded_ethernet_switch hirschmann_rail_switch_power_enhanced hirschmann_rail_switch_power_smart hirschmann_octopus hirschmann_greyhound_swtich hirschmann_rail_switch_power hirschmann_mice_switch_power HiSecOS for device EAGLE20/30 HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED

CWE ID-CWE-12

ASP.NET Misconfiguration: Missing Custom Error Page

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2023-24482

Matching Score-10

Assigner-Siemens

Matching Score-10

Assigner-Siemens

CVSS Score-10||CRITICAL

EPSS-0.23% / 45.82%

7 Day CHG~0.00%

Published-14 Feb, 2023 | 10:36

Updated-20 Mar, 2025 | 16:14

A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33), COMOS V10.3.3.3 (All versions < V10.3.3.3.9), COMOS V10.3.3.4 (All versions < V10.3.3.4.6), COMOS V10.4.0.0 (All versions < V10.4.0.0.31), COMOS V10.4.1.0 (All versions < V10.4.1.0.32), COMOS V10.4.2.0 (All versions < V10.4.2.0.25). Cache validation service in COMOS is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.

Vendor-Siemens AG

Product-comos COMOS V10.3.3.1 COMOS V10.3.3.3 COMOS V10.3.3.4 COMOS V10.3.3.2 COMOS V10.4.2.0 COMOS V10.2 COMOS V10.4.0.0 COMOS V10.4.1.0

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2023-43504

Matching Score-10

Assigner-Siemens

Matching Score-10

Assigner-Siemens

CVSS Score-9.6||CRITICAL

EPSS-0.23% / 45.84%

7 Day CHG~0.00%

Published-14 Nov, 2023 | 11:03

Updated-08 Jan, 2025 | 16:40

A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.

Vendor-Siemens AG

Product-comos COMOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-10042

Matching Score-10

Assigner-Siemens

Matching Score-10

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 78.87%

7 Day CHG~0.00%

Published-14 Jul, 2020 | 13:18

Updated-04 Aug, 2024 | 10:50

A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network.

Vendor-Siemens AG

Product-sicam_t_firmware sicam_mmu sicam_sgu_firmware sicam_mmu_firmware sicam_sgu sicam_t SICAM T SICAM MMU SICAM SGU

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2019-5319

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.74% / 81.72%

7 Day CHG~0.00%

Published-30 Mar, 2021 | 01:45

Updated-04 Aug, 2024 | 19:54

Product-scalance_w1750d_firmware instant scalance_w1750d Aruba Instant Access Points

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-3177

Matching Score-10

Assigner-MITRE Corporation

Product-debian_linux communications_pricing_design_center communications_cloud_native_core_network_function_cloud_native_environment ontap_select_deploy_administration_utility communications_offline_mediation_controller fedora active_iq_unified_manager zfs_storage_appliance_kit enterprise_manager_ops_center python n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.04% / 9.44%

7 Day CHG~0.00%

Published-19 Jan, 2021 | 00:00

Updated-03 Aug, 2024 | 16:45

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Vendor-n/a NetApp, Inc.Python Software Foundation Oracle Corporation Debian GNU/Linux Fedora Project

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-31895

Matching Score-10

Assigner-Siemens

Product-ruggedcom_ros_rmc20 ruggedcom_ros_rsg2100 ruggedcom_rs8000 ruggedcom_rs910 ruggedcom_rsg900 ruggedcom_ros_rs900gp ruggedcom_ros_i800 ruggedcom_ros_rs8000 ruggedcom_rs900g ruggedcom_rsg900c ruggedcom_rsg2300 ruggedcom_ros_rs401 ruggedcom_ros_i801 ruggedcom_ros_rmc30 ruggedcom_rp110 ruggedcom_rsg900g ruggedcom_rst2228 ruggedcom_rs900gp ruggedcom_ros_rs920w ruggedcom_rsg2200 ruggedcom_ros_rmc40 ruggedcom_rs910w ruggedcom_rsg2488 ruggedcom_rst916p ruggedcom_m2200 ruggedcom_ros_rs416 ruggedcom_rs920l ruggedcom_rsg2100 ruggedcom_rs8000a ruggedcom_ros_m969 ruggedcom_rsg920p ruggedcom_rmc40 ruggedcom_rs900l ruggedcom_ros_rsg2100p ruggedcom_rmc20 ruggedcom_ros_rs969 ruggedcom_ros_rs910l ruggedcom_ros_rsg2288 ruggedcom_rsg900r ruggedcom_ros_i802 ruggedcom_rmc ruggedcom_rs401 ruggedcom_ros_rs900w ruggedcom_ros_rsg900c ruggedcom_rs900 ruggedcom_rs930l ruggedcom_rs920w ruggedcom_ros_i803 ruggedcom_ros_rmc8388 ruggedcom_rs416 ruggedcom_ros_rs8000t ruggedcom_ros_rs900 ruggedcom_ros_rsg900r ruggedcom_ros_rst2228 ruggedcom_rs930w ruggedcom_ros_rs910w ruggedcom_ros_rs900g ruggedcom_ros_rsg2300 ruggedcom_ros_rs416v2 ruggedcom_rsg2300p ruggedcom_rmc30 ruggedcom_ros_rsg900g ruggedcom_rs969 ruggedcom_ros_rs940g ruggedcom_rs416v2 ruggedcom_i803 ruggedcom_ros_rs900l ruggedcom_i802 ruggedcom_ros_rs8000h ruggedcom_rs8000h ruggedcom_rs400 ruggedcom_ros_rsg920p ruggedcom_rs940g ruggedcom_i801 ruggedcom_ros_rsl910 ruggedcom_rs8000t ruggedcom_ros_rst916p ruggedcom_rsl910 ruggedcom_ros_rp110 ruggedcom_ros_rsg2300p ruggedcom_ros_rs910 ruggedcom_ros_rst916c ruggedcom_ros_rs400 ruggedcom_rsg2288 ruggedcom_m2100 ruggedcom_ros_rs930l ruggedcom_ros_m2100 ruggedcom_rst916c ruggedcom_ros_m2200 ruggedcom_ros_rsg2200 ruggedcom_ros_rmc41 ruggedcom_rs900w ruggedcom_ros_rs8000a ruggedcom_m969 ruggedcom_ros_rsg900 ruggedcom_ros_rs920l ruggedcom_rmc41 ruggedcom_ros_rmc ruggedcom_rmc8388 ruggedcom_ros_rsg2488 ruggedcom_rsg2100p ruggedcom_i800 ruggedcom_rs910l ruggedcom_ros_rs930w RUGGEDCOM RS910W RUGGEDCOM M969 RUGGEDCOM RS1600F RUGGEDCOM RS900 (32M) V5.X RUGGEDCOM RSL910 RUGGEDCOM RSG2300 V5.X RUGGEDCOM RS400 RUGGEDCOM RST2228 RUGGEDCOM i803 RUGGEDCOM RSG920P V4.X RUGGEDCOM RS416v2 V5.X RUGGEDCOM RMC30 RUGGEDCOM i800 RUGGEDCOM RMC8388 V5.X RUGGEDCOM RS910L RUGGEDCOM RS900G (32M) V5.X RUGGEDCOM RSG2100PNC (32M) V5.X RUGGEDCOM RS930W RUGGEDCOM RS969 RUGGEDCOM i802 RUGGEDCOM RS1600 RUGGEDCOM RSG2288 V5.X RUGGEDCOM RS900G RUGGEDCOM RS416v2 V4.X RUGGEDCOM RS920W RUGGEDCOM RSG2100 (32M) V4.X RUGGEDCOM RSG2100P RUGGEDCOM RSG2100P (32M) V5.X RUGGEDCOM RMC8388 V4.X RUGGEDCOM RP110 RUGGEDCOM RSG2100 RUGGEDCOM RS8000A RUGGEDCOM RS900W RUGGEDCOM RSG2200 RUGGEDCOM M2200 RUGGEDCOM RS940G RUGGEDCOM RSG2300P V4.X RUGGEDCOM RSG2300 V4.X RUGGEDCOM RS8000T RUGGEDCOM RS900G (32M) V4.X RUGGEDCOM RST2228P RUGGEDCOM RSG908C RUGGEDCOM RS416Pv2 V5.X RUGGEDCOM RS900GP RUGGEDCOM RSG2300P V5.X RUGGEDCOM RST916P RUGGEDCOM RS920L RUGGEDCOM RS900L RUGGEDCOM RS416Pv2 V4.X RUGGEDCOM RS1600T RUGGEDCOM RS8000 RUGGEDCOM RS401 RUGGEDCOM RS900 (32M) V4.X RUGGEDCOM RST916C RUGGEDCOM RSG2488 V5.X RUGGEDCOM RSG2488 V4.X RUGGEDCOM i801 RUGGEDCOM RS930L RUGGEDCOM RSG2100 (32M) V5.X RUGGEDCOM RSG909R RUGGEDCOM RSG920P V5.X RUGGEDCOM RS910 RUGGEDCOM M2100 RUGGEDCOM RSG907R RUGGEDCOM RS416 RUGGEDCOM RS416P RUGGEDCOM RSG2100PNC (32M) V4.X RUGGEDCOM RS8000H RUGGEDCOM RSG2288 V4.X RUGGEDCOM RSG910C RUGGEDCOM RSG2100P (32M) V4.X

Matching Score-10

Assigner-Siemens

CVSS Score-8.1||HIGH

EPSS-2.33% / 84.19%

7 Day CHG~0.00%

Published-13 Jul, 2021 | 11:02

Updated-13 May, 2025 | 10:15

A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All versions < V4.3.7), RUGGEDCOM i803 (All versions < V4.3.7), RUGGEDCOM M2100 (All versions < V4.3.7), RUGGEDCOM M2200 (All versions < V4.3.7), RUGGEDCOM M969 (All versions < V4.3.7), RUGGEDCOM RMC30 (All versions < V4.3.7), RUGGEDCOM RMC8388 V4.X (All versions < V4.3.7), RUGGEDCOM RMC8388 V5.X (All versions < V5.5.4), RUGGEDCOM RP110 (All versions < V4.3.7), RUGGEDCOM RS1600 (All versions < V4.3.7), RUGGEDCOM RS1600F (All versions < V4.3.7), RUGGEDCOM RS1600T (All versions < V4.3.7), RUGGEDCOM RS400 (All versions < V4.3.7), RUGGEDCOM RS401 (All versions < V4.3.7), RUGGEDCOM RS416 (All versions < V4.3.7), RUGGEDCOM RS416P (All versions < V4.3.7), RUGGEDCOM RS416Pv2 V4.X (All versions < V4.3.7), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.5.4), RUGGEDCOM RS416v2 V4.X (All versions < V4.3.7), RUGGEDCOM RS416v2 V5.X (All versions < 5.5.4), RUGGEDCOM RS8000 (All versions < V4.3.7), RUGGEDCOM RS8000A (All versions < V4.3.7), RUGGEDCOM RS8000H (All versions < V4.3.7), RUGGEDCOM RS8000T (All versions < V4.3.7), RUGGEDCOM RS900 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RS900G (All versions < V4.3.7), RUGGEDCOM RS900G (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RS900GP (All versions < V4.3.7), RUGGEDCOM RS900L (All versions < V4.3.7), RUGGEDCOM RS900W (All versions < V4.3.7), RUGGEDCOM RS910 (All versions < V4.3.7), RUGGEDCOM RS910L (All versions < V4.3.7), RUGGEDCOM RS910W (All versions < V4.3.7), RUGGEDCOM RS920L (All versions < V4.3.7), RUGGEDCOM RS920W (All versions < V4.3.7), RUGGEDCOM RS930L (All versions < V4.3.7), RUGGEDCOM RS930W (All versions < V4.3.7), RUGGEDCOM RS940G (All versions < V4.3.7), RUGGEDCOM RS969 (All versions < V4.3.7), RUGGEDCOM RSG2100 (All versions), RUGGEDCOM RSG2100 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RSG2100P (All versions < V4.3.7), RUGGEDCOM RSG2100P (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RSG2100PNC (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RSG2100PNC (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RSG2200 (All versions < V4.3.7), RUGGEDCOM RSG2288 V4.X (All versions < V4.3.7), RUGGEDCOM RSG2288 V5.X (All versions < V5.5.4), RUGGEDCOM RSG2300 V4.X (All versions < V4.3.7), RUGGEDCOM RSG2300 V5.X (All versions < V5.5.4), RUGGEDCOM RSG2300P V4.X (All versions < V4.3.7), RUGGEDCOM RSG2300P V5.X (All versions < V5.5.4), RUGGEDCOM RSG2488 V4.X (All versions < V4.3.7), RUGGEDCOM RSG2488 V5.X (All versions < V5.5.4), RUGGEDCOM RSG907R (All versions < V5.5.4), RUGGEDCOM RSG908C (All versions < V5.5.4), RUGGEDCOM RSG909R (All versions < V5.5.4), RUGGEDCOM RSG910C (All versions < V5.5.4), RUGGEDCOM RSG920P V4.X (All versions < V4.3.7), RUGGEDCOM RSG920P V5.X (All versions < V5.5.4), RUGGEDCOM RSL910 (All versions < V5.5.4), RUGGEDCOM RST2228 (All versions < V5.5.4), RUGGEDCOM RST2228P (All versions < V5.5.4), RUGGEDCOM RST916C (All versions < V5.5.4), RUGGEDCOM RST916P (All versions < V5.5.4). The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten, potentially allowing remote code execution.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-12261

Matching Score-10

Assigner-MITRE Corporation

Product-power_meter_9810_firmware hirschmann_rsp20 ruggedcom_win7025_firmware hirschmann_ees25 sonicos hirschmann_grs1030 hirschmann_grs1142 ruggedcom_win7018_firmware hirschmann_rspe32 hirschmann_grs1130 garrettcom_magnum_dx940e hirschmann_rspe35 hirschmann_eesx20 hirschmann_rspe37 ruggedcom_win7018 power_meter_9410_firmware hirschmann_grs1042 siprotec_5_firmware ruggedcom_win7000 ruggedcom_win7200 hirschmann_rsp35 garrettcom_magnum_dx940e_firmware e-series_santricity_os_controller vxworks hirschmann_msp40 hirschmann_octopus_os3 hirschmann_rsp30 communications_eagle hirschmann_dragon_mach4000 hirschmann_dragon_mach4500 hirschmann_msp32 hirschmann_rsp25 hirschmann_rail_switch_power_smart hirschmann_eesx30 hirschmann_grs1020 hirschmann_rail_switch_power_lite hirschmann_eagle20 hirschmann_eagle30 hirschmann_hios ruggedcom_win7025 hirschmann_rspe30 hirschmann_eagle_one ruggedcom_win7200_firmware siprotec_5 hirschmann_ees20 hirschmann_red25 power_meter_9410 power_meter_9810 ruggedcom_win7000_firmware hirschmann_msp30 hirschmann_grs1120 n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-17.18% / 94.75%

7 Day CHG~0.00%

Published-09 Aug, 2019 | 20:27

Updated-04 Aug, 2024 | 23:17

Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.

Vendor-belden windriver n/a NetApp, Inc.Oracle Corporation SonicWall Inc.Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2019-12260

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-26.20% / 96.09%

7 Day CHG~0.00%

Published-09 Aug, 2019 | 20:18

Updated-04 Aug, 2024 | 23:17

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.

Vendor-belden windriver n/a NetApp, Inc.Oracle Corporation SonicWall Inc.Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2019-12256

Matching Score-10

Assigner-MITRE Corporation

Product-power_meter_9810_firmware hirschmann_rsp20 ruggedcom_win7025_firmware hirschmann_ees25 sonicos hirschmann_grs1030 hirschmann_grs1142 ruggedcom_win7018_firmware hirschmann_rspe32 hirschmann_grs1130 garrettcom_magnum_dx940e hirschmann_rspe35 hirschmann_eesx20 hirschmann_rspe37 ruggedcom_win7018 power_meter_9410_firmware hirschmann_grs1042 siprotec_5_firmware ruggedcom_win7000 ruggedcom_win7200 hirschmann_rsp35 garrettcom_magnum_dx940e_firmware e-series_santricity_os_controller vxworks hirschmann_msp40 hirschmann_octopus_os3 hirschmann_rsp30 hirschmann_dragon_mach4000 hirschmann_dragon_mach4500 hirschmann_msp32 hirschmann_rsp25 hirschmann_rail_switch_power_smart hirschmann_eesx30 hirschmann_grs1020 hirschmann_rail_switch_power_lite hirschmann_eagle20 hirschmann_eagle30 hirschmann_hios ruggedcom_win7025 hirschmann_rspe30 hirschmann_eagle_one ruggedcom_win7200_firmware siprotec_5 hirschmann_ees20 hirschmann_red25 power_meter_9410 power_meter_9810 ruggedcom_win7000_firmware hirschmann_msp30 hirschmann_grs1120 n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-17.71% / 94.85%

7 Day CHG~0.00%

Published-09 Aug, 2019 | 17:57

Updated-04 Aug, 2024 | 23:17

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.

Vendor-belden windriver n/a NetApp, Inc.Siemens AG SonicWall Inc.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2024-52533

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.19% / 78.00%

7 Day CHG~0.00%

Published-11 Nov, 2024 | 00:00

Updated-17 Jun, 2025 | 01:23

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

Vendor-n/a Debian GNU/Linux The GNOME Project NetApp, Inc.

Product-glib ontap_tools active_iq_unified_manager debian_linux n/a glib

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37885

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 78.89%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

Product-arubaos scalance_w1750d_firmware instant scalance_w1750d Aruba Access Points; 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37891

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-0.82% / 73.45%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-37434

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-92.68% / 99.74%

7 Day CHG~0.00%

Published-05 Aug, 2022 | 00:00

Updated-30 May, 2025 | 20:15

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-37888

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-1.12% / 77.34%

7 Day CHG~0.00%

Published-06 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 10:37

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-7593

Matching Score-10

Assigner-Siemens

Matching Score-10

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-17.29% / 94.78%

7 Day CHG~0.00%

Published-14 Jul, 2020 | 13:18

Updated-04 Aug, 2024 | 09:33

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.02). A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacker could send a specially crafted HTTP request to cause a memory corruption, potentially resulting in remote code execution.

Vendor-Siemens AG

Product-logo\!_8_bm logo\!_8_bm_firmware LOGO! 8 BM (incl. SIPLUS variants)

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-5135

Matching Score-10

Assigner-SonicWall, Inc.

Matching Score-10

Assigner-SonicWall, Inc.

CVSS Score-9.8||CRITICAL

EPSS-32.75% / 96.72%

7 Day CHG~0.00%

Published-12 Oct, 2020 | 10:40

Updated-30 Jul, 2025 | 01:45

Known KEV||Action Due Date - 2022-04-05||Apply updates per vendor instructions.

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.

Vendor-SonicWall Inc.

Product-sonicos sonicosv SonicOS SonicOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2018-9866

Matching Score-8

Assigner-SonicWall, Inc.

Matching Score-8

Assigner-SonicWall, Inc.

CVSS Score-9.8||CRITICAL

EPSS-11.74% / 93.43%

7 Day CHG~0.00%

Published-03 Aug, 2018 | 20:00

Updated-05 May, 2025 | 19:15

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.

Vendor-SonicWall Inc.

Product-global_management_system Global Management System (GMS)

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE ID-CWE-20

Improper Input Validation

CVE-2019-0708

Matching Score-8

Assigner-Microsoft Corporation

Product-ch240 uma axiom_multix_m rh1288_v2_firmware rh5885_v3 multix_pro_acss axiom_vertix_solitaire_m syngo_lab_process_manager x6000 multix_pro_acss_firmware axiom_multix_m_firmware multix_swing_firmware rh5885_v3_firmware oceanstor_hvs85t multix_pro_p_firmware bh622_v2_firmware oceanstor_18500 bh621_v2_firmware rh2265_v2 windows_7 ch140 bh620_v2 aptio_firmware ch121 oceanstor_18500_firmware rh1288a_v2_firmware rh2285h_v2 ch221_firmware espace_ecs_firmware gtsoftx3000_firmware smc2.0_firmware ch242_v3 centralink multix_top_acss_p multix_pro atellica_solution ch242 uma_firmware rh2288e_v2 smc2.0 rh2288h_v2 rapidpoint_500_firmware ch221 oceanstor_hvs85t_firmware rh2288_v2 lantis rh2285_v2_firmware e6000_chassis_firmware elog_firmware multix_top_p bh640_v2 ch240_firmware rh1288_v2 seco_vsm viva_e_firmware rh2485_v2 rh2288_v2_firmware ch222_firmware ch140_firmware vertix_solitaire_firmware lantis_firmware rh5885_v2 ch220_firmware multix_swing aptio rapidpoint_500 streamlab_firmware agile_controller-campus_firmware mobilett_xp_digital_firmware rh2268_v2 x8000 axiom_vertix_md_trauma_firmware multix_pro_navy_firmware rh1288a_v2 x8000_firmware rh5885_v2_firmware gtsoftx3000 vertix_solitaire atellica_solution_firmware ch220 multix_pro_firmware bh622_v2 multix_top_acss_firmware axiom_vertix_md_trauma rh2285_v2 oceanstor_hvs88t_firmware windows_server_2008 oceanstor_18800f rh2265_v2_firmware rh2268_v2_firmware elog multix_top bh621_v2 rh2288a_v2_firmware mobilett_xp_digital e6000_firmware bh640_v2_firmware multix_pro_acss_p_firmware ch242_firmware rh2285h_v2_firmware rh2288e_v2_firmware oceanstor_18800f_firmware viva_e x6000_firmware bh620_v2_firmware espace_ecs e6000 centralink_firmware ch121_firmware multix_top_firmware multix_top_p_firmware viva_twin rh2288a_v2 multix_top_acss multix_pro_acss_p e6000_chassis multix_pro_p axiom_vertix_solitaire_m_firmware oceanstor_18800 oceanstor_18800_firmware ch242_v3_firmware agile_controller-campus rh2485_v2_firmware multix_top_acss_p_firmware seco_vsm_firmware streamlab rh2288h_v2_firmware multix_pro_navy ch222 oceanstor_hvs88t viva_twin_firmware Windows Server Windows Remote Desktop Services

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.8||CRITICAL

EPSS-94.44% / 99.99%

7 Day CHG~0.00%

Published-16 May, 2019 | 18:17

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

Vendor-Microsoft Corporation Siemens AG Huawei Technologies Co., Ltd.

CWE ID-CWE-416

Use After Free

CVE-2001-1104

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-4.35% / 88.49%

7 Day CHG~0.00%

Published-15 Mar, 2002 | 05:00

Updated-03 Apr, 2025 | 01:03

SonicWALL SOHO uses easily predictable TCP sequence numbers, which allows remote attackers to spoof or hijack sessions.

Vendor-n/a SonicWall Inc.

Product-soho soho_firmware n/a

CVE-2019-0192

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-93.43% / 99.81%

7 Day CHG~0.00%

Published-07 Mar, 2019 | 21:00

Updated-16 Sep, 2024 | 16:53

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

Vendor-NetApp, Inc.The Apache Software Foundation

Product-solr storage_automation_store Apache Solr

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2018-8014

Matching Score-8

Matching Score-8

Vendor-Canonical Ltd.The Apache Software Foundation NetApp, Inc.Microsoft Corporation Debian GNU/Linux

CVSS Score-9.8||CRITICAL

EPSS-53.87% / 97.91%

7 Day CHG~0.00%

Published-16 May, 2018 | 16:00

Updated-05 Aug, 2024 | 06:46

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Product-ubuntu_linux debian_linux snapcenter_server storage_automation_store windows tomcat oncommand_workflow_automation oncommand_unified_manager oncommand_insight Apache Tomcat

CWE ID-CWE-1188

Initialization of a Resource with an Insecure Default

CVE-1999-0017

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.13% / 77.41%

7 Day CHG~0.00%

Published-29 Sep, 1999 | 04:00

Updated-03 Apr, 2025 | 01:03

FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.

CVE-2018-4852

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-2.28% / 84.05%

7 Day CHG~0.00%

Published-03 Jul, 2018 | 14:00

Updated-17 Sep, 2024 | 03:07

A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could potentially circumvent the authentication mechanism if he/she is able to obtain certain knowledge specific to the attacked device.

Vendor-Siemens AG

Product-siclock_tc400 siclock_tc400_firmware siclock_tc100_firmware siclock_tc100 SICLOCK TC100, SICLOCK TC400

CWE ID-CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE ID-CWE-287

Improper Authentication

CVE-2016-20009

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.42% / 60.85%

7 Day CHG~0.00%

Published-11 Mar, 2021 | 21:39

Updated-06 Aug, 2024 | 04:16

A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Vendor-windriver n/a Siemens AG

Product-sgt-400 sgt-a65_firmware sgt-100 sgt-300_firmware vxworks sgt-200_firmware sgt-400_firmware sgt-a20 sgt-100_firmware sgt-200 sgt-300 sgt-a35 sgt-a65 sgt-a35_firmware sgt-a20_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-1502

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.3||HIGH

EPSS-0.13% / 33.12%

7 Day CHG~0.00%

Published-07 Feb, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspecified vectors.

Vendor-n/a NetApp, Inc.

Product-snapcenter_server n/a

CWE ID-CWE-287

Improper Authentication

CVE-2018-5379

Matching Score-8

Assigner-CERT/CC

Product-enterprise_linux_server ubuntu_linux debian_linux enterprise_linux_server_eus quagga enterprise_linux_server_aus enterprise_linux_workstation ruggedcom_rox_ii_firmware enterprise_linux_server_tus ruggedcom_rox_ii bgpd

Matching Score-8

Assigner-CERT/CC

CVSS Score-7.5||HIGH

EPSS-15.49% / 94.40%

7 Day CHG~0.00%

Published-19 Feb, 2018 | 13:00

Updated-17 Sep, 2024 | 03:22

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.

Vendor-quagga Quagga Debian GNU/Linux Red Hat, Inc.Canonical Ltd.Siemens AG

CWE ID-CWE-415

Double Free

CVE-2018-5469

Matching Score-8

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-0.04% / 13.19%

7 Day CHG~0.00%

Published-06 Mar, 2018 | 21:00

Updated-05 Aug, 2024 | 05:33

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An improper restriction of excessive authentication vulnerability in the web interface has been identified, which may allow an attacker to brute force authentication.

Vendor-belden n/a

CWE ID-CWE-307

Improper Restriction of Excessive Authentication Attempts

CVE-2024-27939

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.77% / 72.49%

7 Day CHG~0.00%

Published-14 May, 2024 | 10:02

Updated-06 Feb, 2025 | 18:16

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow the upload of arbitrary files of any unauthenticated user. An attacker could leverage this vulnerability and achieve arbitrary code execution with system privileges.

Vendor-Siemens AG

Product-ruggedcom_crossbow RUGGEDCOM CROSSBOW ruggedcom_crossbow

CWE ID-CWE-862

Missing Authorization

CVE-2018-5492

Matching Score-8

Assigner-NetApp, Inc.

Matching Score-8

Assigner-NetApp, Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.13% / 83.45%

7 Day CHG~0.00%

Published-04 Oct, 2018 | 13:00

Updated-17 Sep, 2024 | 01:21

NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution.

Vendor-NetApp, Inc.

Product-e-series_santricity_os_controller E-Series SANtricity OS Controller Software

CWE ID-CWE-20

Improper Input Validation

CVE-2018-5487

Matching Score-8

Assigner-NetApp, Inc.

Matching Score-8

Assigner-NetApp, Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.49% / 84.69%

7 Day CHG~0.00%

Published-24 May, 2018 | 14:00

Updated-16 Sep, 2024 | 22:30

NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.

Vendor-NetApp, Inc.Linux Kernel Organization, Inc

Product-oncommand_unified_manager linux_kernel OnCommand Unified Manager for Linux

CWE ID-CWE-20

Improper Input Validation

CVE-2018-5495

Matching Score-8

Assigner-NetApp, Inc.

Matching Score-8

Assigner-NetApp, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.73% / 71.86%

7 Day CHG~0.00%

Published-14 Nov, 2018 | 19:00

Updated-05 Aug, 2024 | 05:40

All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with systems on the same network as the StorageGRID Webscale Admin Node via HTTP or to take over services on the Admin Node.

Vendor-NetApp, Inc.

Product-storagegrid_webscale StorageGRID Webscale

CVE-2018-5488

Matching Score-8

Assigner-NetApp, Inc.

Matching Score-8

Assigner-NetApp, Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.24% / 83.87%

7 Day CHG~0.00%

Published-13 Jun, 2018 | 20:00

Updated-16 Sep, 2024 | 23:01

NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.

Vendor-NetApp, Inc.

Product-santricity_web_services_proxy santricity_storage_manager SANtricity Products

CWE ID-CWE-20

Improper Input Validation

CVE-2018-7183

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-10.50% / 92.95%

7 Day CHG~0.00%

Published-08 Mar, 2018 | 20:00

Updated-05 Aug, 2024 | 06:24

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

Vendor-ntp n/a FreeBSD Foundation NetApp, Inc.Canonical Ltd.

Product-freebsd ntp element_software ubuntu_linux n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-7084

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.79% / 89.05%

7 Day CHG~0.00%

Published-10 May, 2019 | 17:14

Updated-05 Aug, 2024 | 06:17

A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1