Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-20165

Publication date:

30/12/2021

Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the server does not appear to validate them properly (i.e. re-using an old token or finding the token thru some other method is possible).

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2022

CVE-2021-20166

Publication date:

30/12/2021

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2022

CVE-2021-20169

Publication date:

30/12/2021

Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-20170

Publication date:

30/12/2021

Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-20171

Publication date:

30/12/2021

Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device&#39;s associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-20174

Publication date:

30/12/2021

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device&#39;s web interface is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-20175

Publication date:

30/12/2021

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device&#39;s SOAP Interface (port 5000) is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-23147

Publication date:

30/12/2021

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-20167

Publication date:

30/12/2021

Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2022

CVE-2021-20159

Publication date:

30/12/2021

Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a malformed parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-20160

Publication date:

30/12/2021

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when configuring smb functionality for the device is vulnerable to command injection as root.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-20161

Publication date:

30/12/2021

Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with full control of the device.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

Subscribe to Vulnerabilities