http://cyber-defence-campus.github.io/projects/vulnerabilities/Recent content in Vulnerabilities on Research @ Cyber-Defence CampusHugo -- gohugo.ioen-usFri, 07 Aug 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71412/Fri, 07 Aug 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71412/CPDLC over ATN-B1 accepts injected emergency or status messages as legitimate without adequate checks (CWE-754). Carried out remotely over radio frequency, this may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, air traffic controllers, and ground operations. CISA ICS advisory: ICSA-26-219-01.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71410/Fri, 07 Aug 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71410/Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate CPDLC sessions over ATN-B1 (CWE-770). An attacker operating remotely over radio frequency can cause a loss of CPDLC functions, forcing a reversion to voice communication and increasing controller workload. CISA ICS advisory: ICSA-26-219-01.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71409/Fri, 07 Aug 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71409/Controller-Pilot Data Link Communications (CPDLC) over ATN-B1 does not authenticate Very High Frequency Data Link messages (CWE-306). Rogue ground stations can inject CPDLC messages remotely over radio frequency, leading to unexpected or misleading clearances and potential pilot confusion. CISA ICS advisory: ICSA-26-219-01.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71413/Fri, 07 Aug 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71413/Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers of CPDLC over ATN-B1 cause repeated resets (CWE-754). Carried out remotely over radio frequency, this may result in increased workload and reduced situational awareness. CISA ICS advisory: ICSA-26-219-01.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71411/Fri, 07 Aug 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-71411/Broadcast control frames in CPDLC over ATN-B1 can disconnect multiple aircraft simultaneously (CWE-770). Carried out remotely over radio frequency, this leads to delayed clearances and air traffic controller overload. CISA ICS advisory: ICSA-26-219-01.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55729/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55729/Loytec LWEB-802 before 5.0.8 stores management credentials in the browser’s localStorage without adequate protection (CWE-200). An unauthenticated remote attacker can leak the stored credentials by luring a user into opening a crafted link.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12504/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12504/The PAM configuration of Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 (LINX-A64) accepts empty passwords (CWE-287, CWE-521). A local attacker can authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an empty password field.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12503/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12503/Improper link resolution before file access (CWE-59) in /usr/bin/larm_starter on Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 (LINX-A64) allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group via a symlink attack on /etc/lighttpd/ssl/server.pem, which leads to root privilege escalation.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12502/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12502/Improper privilege management (CWE-269) in /usr/bin/ltsudo on Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 (LINX-A64) allows an attacker in the superadmin group to reset the password of any LARM user, including the larmapp service account, through the set-passwd subcommand.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55732/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55732/An out-of-bounds read (CWE-125) in the BACnet packet parsing routine bacdt_datetime_to_tod of Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 (LINX-A64) allows an unauthenticated remote attacker to crash linx_a64.exe and ultimately reboot the device by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same defect affects several further Loytec products.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55730/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55730/Loytec LWEB-802 before 5.0.8 fails to neutralise the project and mspParams request parameters before reflecting them into the generated page (CWE-79, CWE-116). An unauthenticated remote attacker can execute arbitrary JavaScript in a victim’s browser via a crafted link and thereby perform actions with the victim’s privileges.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55728/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55728/A stack-based buffer overflow (CWE-121) in the cmd_ipaddr_conflict handler of /usr/bin/ltsudo on Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 (LINX-A64) allows an attacker in the superadmin group to abort the SUID-root process, or potentially elevate privileges, by supplying an overly long interface-name argument.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12496/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-12496/The OPC XML-DA server statistics page of Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 (LINX-A64) stores and renders the User-Agent header without neutralisation (CWE-79, CWE-116). An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator’s browser via a crafted User-Agent header in a POST /da request, enabling session hijacking, credential theft and device reconfiguration.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55731/Fri, 24 Jul 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-55731/The SNMP agent of Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 (LINX-A64) uses attacker-controlled input as a loop condition without validation (CWE-606). An unauthenticated remote attacker can cause a persistent denial of service through CPU exhaustion by sending a crafted SNMP GETNEXT request containing a large OID component.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35076/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35076/The bac-scanresult method of the MBS UGW web GUI (firmware before V6_00_07) validates user-controlled input insufficiently (CWE-73). A remote attacker with user privileges can delete arbitrary local files.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35077/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35077/The ugw-delete-file method of the MBS UGW web GUI (firmware before V6_00_07) validates user-controlled input insufficiently (CWE-73). A remote attacker with user privileges can delete arbitrary local files.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35078/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35078/The ugw-logstop method of the MBS UGW web GUI (firmware before V6_00_07) validates user-controlled input insufficiently (CWE-73). A remote attacker with user privileges can delete arbitrary local files.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35079/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35079/The ugw-restore method of the MBS UGW web GUI (firmware before V6_00_07) validates user-controlled input insufficiently (CWE-73). A remote attacker with user privileges can delete arbitrary local files.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35080/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35080/The ugw-restoreinfo method of the MBS UGW web GUI (firmware before V6_00_07) validates user-controlled input insufficiently (CWE-73). A remote attacker with user privileges can delete arbitrary local files.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35081/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35081/The ugw-logstop method of the MBS UGW web GUI (firmware before V6_00_07) validates user-supplied input insufficiently (CWE-20). A remote attacker with user privileges can terminate arbitrary processes on the device.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35082/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35082/The ugw-logread method of the MBS UGW web GUI (firmware before V6_00_07) validates user-supplied input insufficiently (CWE-22). A remote attacker with user privileges can read arbitrary local files through path traversal.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35083/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35083/A stack-based buffer overflow (CWE-121) in the bac-deviceobject method of the MBS UGW web GUI (firmware before V6_00_07) allows a remote attacker with user privileges to gain full system access as root.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35084/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35084/A stack-based buffer overflow (CWE-121) in the dali-devconfig method of the MBS UGW web GUI (firmware before V6_00_07) allows a remote attacker with user privileges to gain full system access as root.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35085/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35085/A stack-based buffer overflow (CWE-121) in the gdv-serverconfig method of the MBS UGW web GUI (firmware before V6_00_07) allows a remote attacker with user privileges to gain full system access as root.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35075/Wed, 03 Jun 2026 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2026-35075/The MBS UGW Universal Gateway firmware before V6_00_07 ships with a hard-coded default password for a service account (CWE-1393). An unauthenticated remote attacker can recover this password from a firmware image and thereby gain full access to all affected devices.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41730/Wed, 10 Dec 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41730/The vulnerabilities are exploitable without authentication and may allow remote code execution or cause denial of service. Exploitation can disable the web interface until manual intervention, as no automatic recovery mechanisms are in place.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41732/Wed, 10 Dec 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41732/An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41724/Wed, 22 Oct 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41724/An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41721/Wed, 22 Oct 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41721/A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralisation of special elements when adding a password protected self-signed certificate.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41719/Wed, 22 Oct 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41719/A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41723/Wed, 22 Oct 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41723/The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41720/Wed, 22 Oct 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41720/A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41722/Wed, 22 Oct 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-41722/The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-1718/Tue, 24 Jun 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2025-1718/An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space management.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-13503/Fri, 17 Jan 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-13503/Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-13502/Fri, 17 Jan 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-13502/Improper Neutralisation of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability.http://cyber-defence-campus.github.io/projects/vulnerabilities/stack-buffer-overflow/Wed, 01 Jan 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/stack-buffer-overflow/http://cyber-defence-campus.github.io/projects/vulnerabilities/traffic-alert-and-collision-avoidance-system-tcas/Wed, 01 Jan 2025 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/traffic-alert-and-collision-avoidance-system-tcas/Successful exploitation of these vulnerabilities could allow an attacker to manipulate safety systems and cause a denial-of-service condition. CISA ICS advisory: ICSA-25-021-01.http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-2/Sun, 01 Sep 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-2/Reported to the manufacturer and fixed.http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-3/Sun, 01 Sep 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-3/Reported to the manufacturer and fixed.http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-4/Sun, 01 Sep 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-4/Reported to the manufacturer and fixed.http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-5/Sun, 01 Sep 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2-5/Reported to the manufacturer and fixed.http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2/Sun, 01 Sep 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/ubr-01-mk2/Reported to the manufacturer and fixed.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6200/Tue, 06 Aug 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6200/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6201/Tue, 06 Aug 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6201/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6202/Tue, 06 Aug 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6202/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6203/Tue, 06 Aug 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-6203/http://cyber-defence-campus.github.io/projects/vulnerabilities/actanova/Thu, 01 Aug 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/actanova/Reported via the internal process and fixed.http://cyber-defence-campus.github.io/projects/vulnerabilities/dns-unbound-powerdns-bind/Thu, 01 Aug 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/dns-unbound-powerdns-bind/Published at USENIX Security 2024.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-27460/Fri, 10 May 2024 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2024-27460/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-41840/Wed, 01 Nov 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-41840/Found independently by several entities and reported to the manufacturer before public disclosure; the CVE is typically attributed to the entity that reported it first.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-47113/Sun, 01 Oct 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-47113/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-40681/Sun, 01 Oct 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-40681/Found independently by several entities and reported to the manufacturer before public disclosure; the CVE is typically attributed to the entity that reported it first.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-36657/Fri, 01 Sep 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-36657/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-36659/Fri, 01 Sep 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2023-36659/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-40682-2/Sat, 01 Apr 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-40682-2/http://cyber-defence-campus.github.io/projects/vulnerabilities/2023-04_sharekey-19-vulnerabilities/Sat, 01 Apr 2023 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/2023-04_sharekey-19-vulnerabilities/19 vulnerabilities reported to the manufacturer.http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-4780/Thu, 01 Dec 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-4780/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-4778/Thu, 01 Dec 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-4778/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-4779/Thu, 01 Dec 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-4779/http://cyber-defence-campus.github.io/projects/vulnerabilities/2022-09_e/Thu, 01 Sep 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/2022-09_e/http://cyber-defence-campus.github.io/projects/vulnerabilities/2022-09_plantronics-hub/Thu, 01 Sep 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/2022-09_plantronics-hub/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-43996/Sun, 01 May 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-43996/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-27193/Tue, 01 Mar 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-27193/http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-0878/Tue, 01 Feb 2022 00:00:00 +0000http://cyber-defence-campus.github.io/projects/vulnerabilities/cve-2022-0878/