CVE Vulnerability Advisory Database

[Affected Scope] ethos utility in RIOT OS versions up to and including 2026.01-devel-317

[Impact] Unauthenticated remote attackers can send crafted serial or TCP-framed input to corrupt memory, leading to application crashes or potential arbitrary code execution

[Mitigation] Apply the latest source code patches, or manually implement bounds checking in the ethos utility's frame parser and rebuild

[Affected Scope] RIOT OS versions up to and including 2026.01-devel-317 containing the tapslip6 utility

[Impact] Attackers can trigger a stack buffer overflow via crafted command-line arguments, leading to process crashes and potential arbitrary code execution

[Mitigation] Apply the latest source patches, replace unsafe string functions with snprintf, and restrict execution permissions on the tapslip6 binary

[Affected Scope] Digiever DS-2105 Pro devices running firmware version 3.1.0.71-11 and prior (including End-of-Life products)

[Impact] Authenticated attackers can execute arbitrary OS commands with root privileges via the vulnerable CGI script

[Mitigation] Immediately isolate affected devices from the public internet and restrict access using firewalls or WAF rules

[Affected Scope] PTZOptics PT30X-SDI/NDI-xx camera devices running firmware versions prior to 6.3.40

[Impact] Attackers can manipulate the 'ntp_addr' configuration to execute arbitrary OS commands with system privileges when 'ntp_client' starts, which can lead to unauthenticated remote code execution when chained with CVE-2024-8956

[Mitigation] Immediately upgrade the camera firmware to version 6.3.40 or later via the official PTZOptics portal and restrict network access

[Affected Scope] Reolink RLC-410W smart IP camera firmware version v3.0.0.136_20121102 and prior

[Impact] An authenticated attacker can execute arbitrary OS commands with root privileges by sending a crafted HTTP request, leading to complete device compromise

[Mitigation] Immediately update to the latest official secure firmware and restrict external access to the camera management interface

[Affected Scope] Certain Dahua IP cameras, NVRs, XVRs, and thermal cameras

[Impact] Attackers can bypass identity authentication during the login process by sending crafted malicious packets, gaining full administrative control

[Mitigation] Immediately apply the latest firmware updates from the vendor and restrict direct internet access to the devices

[Affected Scope] Certain Dahua IP cameras, NVRs, DVRs, and associated firmware versions

[Impact] Attackers can completely bypass the identity authentication process during login and gain full administrative control of the device

[Mitigation] Immediately apply the latest firmware updates provided by the vendor and restrict external network access to the devices

[Affected Scope] D-Link DCS-2530L (prior to 1.06.01 Hotfix) and DCS-2670L (through 2.02) IP camera devices.

[Impact] Authenticated attackers can inject arbitrary system commands via the ddns_enc.cgi script, leading to complete device compromise and potential botnet recruitment.

[Mitigation] Apply the official firmware patches immediately, or isolate the devices from the public internet and restrict access to the management interface.

[Affected Scope] Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices running firmware versions up to and including 1.0.227.

[Impact] An authenticated administrator can inject and execute arbitrary OS commands with root privileges via shell metacharacters in the 'addr1' field of the 'TestEmail' functionality.

[Mitigation] Immediately upgrade to the latest official firmware provided by the manufacturer and restrict network access to the camera's management interface.

[Affected Scope] NUUO NVRmini network video recorder devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted HTTP requests

[Mitigation] Apply the latest firmware updates, restrict external internet access to the management interface, and implement firewall rules