CVE Vulnerability Advisory Database

[Affected Scope] Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 and prior

[Impact] A remote authenticated attacker with admin-level privileges can inject arbitrary OS commands, leading to remote code execution and full system compromise

[Mitigation] Immediately upgrade to the supported Ivanti CSA 5.0 version or apply the latest security patches to mitigate active exploitation risks

[Affected Scope] Cisco Smart Licensing Utility (CSLU) versions prior to 2.3.0

[Impact] Unauthenticated remote attackers can gain full administrative access to the CSLU application API using hardcoded static credentials

[Mitigation] Immediately upgrade CSLU to version 2.3.0 or later, and restrict external access to the CSLU API ports using firewalls

[Affected Scope] SonicWall Firewall Gen 5 and Gen 6 devices, and Gen 7 devices running SonicOS 7.0.1-5035 and older versions

[Impact] Unauthenticated remote attackers can gain unauthorized access to firewall resources and, under specific conditions, cause the firewall to crash, leading to a Denial of Service (DoS)

[Mitigation] Immediately apply the latest firmware patches provided by SonicWall, and restrict or disable WAN management access to the firewall

[Affected Scope] Authenticated Versa Director systems with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges

[Impact] Authenticated attackers can exploit the 'Change Favicon' feature to upload malicious files masquerading as .png images, leading to arbitrary code execution on the host system

[Mitigation] Apply the official security patches from Versa Networks immediately and restrict access to the management GUI to trusted IP addresses only

[Affected Scope] Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136)

[Impact] An authenticated attacker with administrative privileges can execute arbitrary commands with system privileges via argument injection during the boot process

[Mitigation] Immediately upgrade to the patched firmware version recommended by Mitel and restrict access to the administrative interfaces

[Affected Scope] Palo Alto Networks Expedition versions prior to 1.2.92

[Impact] Attackers with network access can bypass authentication to take over the Expedition administrator account, exposing firewall configurations, credentials, and API keys

[Mitigation] Immediately upgrade Expedition to version 1.2.92 or later, and restrict network access to authorized administrator IPs only

[Affected Scope] Cisco NX-OS Software running on Nexus series switches with authenticated Administrator credentials

[Impact] Authenticated administrators can bypass CLI sandboxing and execute arbitrary commands as root on the underlying Linux operating system due to insufficient argument validation

[Mitigation] Apply official Cisco NX-OS software updates immediately and restrict administrative CLI access using robust AAA and ACLs

[Affected Scope] End-of-Life (EOL) GeoVision devices including GV-VS12, GV-VS11, and GV-DSP LPR V3

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, potentially leading to full device takeover and integration into IoT botnets like Mirai

[Mitigation] Since these devices are EOL and no official patches are available, immediately isolate the affected devices from the internet or replace them with supported models

[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)

[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server

[Affected Scope] Check Point Security Gateways connected to the internet with Remote Access VPN or Mobile Access Software Blades enabled

[Impact] Unauthenticated remote attackers can read sensitive system files (e.g., /etc/shadow, password hashes, configuration files), potentially leading to credential theft and full network compromise

[Mitigation] Immediately apply the official hotfix provided in Check Point Advisory sk182336, audit system logs for IoCs, and rotate all sensitive credentials

[Affected Scope] TP-Link TL-WR841N wireless routers

[Impact] Network-adjacent attackers can bypass authentication to access the httpd service (TCP port 80) and disclose stored credentials, leading to full device compromise

[Mitigation] Apply the latest official firmware updates from the vendor and disable remote management features immediately

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software

[Impact] An authenticated, local attacker with administrator privileges can execute arbitrary code with root-level privileges and establish persistence across device reboots by preloading crafted files

[Mitigation] Apply the official security updates provided by Cisco immediately and audit the flash file system for unauthorized files

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software with management or VPN web server enabled.

[Impact] An unauthenticated, remote attacker can trigger an unexpected device reload by sending a crafted HTTP request, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco software patches immediately. Restrict access to management interfaces and monitor VPN ports for anomalous HTTP headers as temporary workarounds.

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures

[Affected Scope] All firmware versions of End-of-Life (EOL) D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L

[Impact] Unauthenticated remote attackers can leverage hardcoded credentials and inject arbitrary system commands to achieve full system compromise

[Mitigation] Since these products are no longer supported, it is strongly recommended to immediately retire and replace the affected devices

[Affected Scope] All firmware versions of legacy D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L.

[Impact] Remote unauthenticated attackers can bypass authentication using hard-coded credentials, leading to complete system compromise and arbitrary code execution.

[Mitigation] Since these devices are End-of-Life (EOL) and will not receive security patches, they must be immediately decommissioned and replaced.

[Affected Scope] Fortinet FortiClientEMS versions 7.2.0 through 7.2.2, and 7.0.1 through 7.0.10

[Impact] An unauthenticated remote attacker can execute unauthorized code or system commands with database server privileges via specially crafted packets, leading to complete system compromise

[Mitigation] Immediately upgrade FortiClientEMS to patched versions (7.2.3+ or 7.0.11+) and restrict access to the management ports

[Affected Scope] Progress Kemp LoadMaster OS (LMOS) versions prior to 7.2.48.10, 7.2.54.8, and 7.2.59.2

[Impact] Unauthenticated remote attackers can access the system via the management interface to execute arbitrary OS commands and gain full system control

[Mitigation] Immediately upgrade to patched LMOS versions (7.2.59.2, 7.2.54.8, 7.2.48.10 or higher) and restrict external access to the management interface

[Affected Scope] On-premise deployments of ConnectWise ScreenConnect version 23.9.7 and prior

[Impact] Attackers can exploit a path traversal vulnerability to escape restricted directories, upload malicious files, and achieve arbitrary remote code execution (RCE)

[Mitigation] Immediately upgrade ConnectWise ScreenConnect to the patched version (23.9.8 or higher)

[Affected Scope] FortiOS (7.0.0~7.0.13, 7.2.0~7.2.6, 7.4.0~7.4.2), FortiProxy (7.0.0~7.0.14, 7.2.0~7.2.8, 7.4.0~7.4.2), FortiPAM, and FortiSwitchManager specific versions

[Impact] Unauthenticated remote attackers can execute unauthorized code or commands with root privileges via specially crafted packets

[Mitigation] Upgrade to the official patched versions immediately, or disable the FGFM (FortiGate Federation Management) service on interfaces as a temporary workaround