A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data.
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default passwor
A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS.
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation.
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_PORTFORWARDING.SRC
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/
A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS.
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users.
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.
Page 1+ Next →