Security Affairs

SEPTEMBER 6, 2021

Netgear has released firmware updates to address high-severity vulnerabilities in more than a dozen of its smart switches used on businesses. The flaws affected multiple products including the following smart switches, below is the list of the impacted devices and related firmware fixes: GC108P fixed in firmware version 1.0.8.2

Firmware 98

Firmware Authentication Passwords Hacking 98

Security Affairs

DECEMBER 14, 2022

Some of the most popular brands don’t enforce a strong password policy, meaning anyone can peer into their owners’ lives. All too often, this gives them a false sense of security: when in fact, threat actors can not only access and watch your camera feed but exploit the unsecured device to hack into your network.

Surveillance 122

Surveillance Manufacturing Passwords Internet 122

Security Affairs

DECEMBER 17, 2019

TP-Link has addressed a critical vulnerability impacting some TP-Link Archer routers that could allow attackers to login without passwords. ” The flaw could allow unauthorized third-party access to the router with admin privileges without proper authentication. .” SecurityAffairs – TP-Link Archer, hacking).

Passwords 90

Passwords Advertising Firmware Authentication 90

Security Affairs

JULY 17, 2021

Network equipment vendor D-Link has released a firmware hotfix to fix multiple vulnerabilities in the DIR-3040 AC3000-based wireless internet router. Network equipment vendor D-Link has released a firmware hotfix to address multiple vulnerabilities affecting the DIR-3040 AC3000-based wireless internet router.

Firmware 114

Firmware Wireless Passwords Internet 114

Security Affairs

AUGUST 1, 2023

The information stored in a Canon printer depends on the specific model, however, almost any model stores the network SSID, the password, network type (WPA3, WEP, etc.), Set up strong authentication mechanisms, such as complex passwords or use multi-factor authentication (MFA) for printer access.

Wireless 90

Wireless Firmware Passwords Authentication 90

Security Affairs

AUGUST 13, 2023

16 vulnerabilities in Codesys products could result in remote code execution and DoS attacks exposing OT environments to hacking. An attacker can trigger the flaw to gain remote code execution and conduct denial-of-service attacks under specific conditions, exposing operational technology (OT) environments to hacking.

Authentication 84

Authentication Firmware Hacking Passwords 84

Security Affairs

AUGUST 14, 2023

The procedures allow administrators to provide device information such as server addresses, account information, and firmware updates. The server is used to provide configurations and firmware updates to the devices. In this scenario, an attacker can act as a rogue server and distribute malicious firmware.

Firmware 84

Firmware Authentication Passwords Hacking 84

Security Affairs

DECEMBER 31, 2021

Researchers discovered multiple high-risk vulnerabilities affecting the latest firmware version for the Netgear Nighthawk R6700v3 router. Researchers from Tenable have discovered multiple vulnerabilities in the latest firmware version (version 1.0.4.120) of the popular Netgear Nighthawk R6700v3 WiFi router. ” states Tenable. .

Firmware 117

Firmware Encryption Authentication Passwords 117

Security Affairs

NOVEMBER 10, 2022

The industrial automation giant ABB addressed the flaw with the release of firmware updates on July 14, 2022. The researchers initially discovered an authentication bypass issue, then explored the systems looking at functionalities available to authenticated users such as uploading and downloading configuration files.

Firmware 125

Firmware Authentication Passwords Manufacturing 125

Security Affairs

DECEMBER 27, 2021

The researchers performed reverse engineering of the firmware image for the COMpact 5500, version 7.8A The experts started investigating the password reset functionality that requests access to the web interface. The experts started investigating the password reset functionality that requests access to the web interface.

Firmware 87

Firmware Manufacturing Passwords Penetration Testing 87

Security Affairs

SEPTEMBER 3, 2019

Researchers at firmware security firm Eclypsium discovered multiple vulnerabilities referred as USBAnywhere that could be exploited to potentially allow an attacker to take over the baseboard management controller (BMC) for three different models of Supermicro server boards: the X9, X10, and X11. ” reads the post published by Eclypsium.

Hacking 83

Hacking Firmware Media Authentication 83

Security Affairs

APRIL 25, 2021

“The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. ” reads the description of the vulnerability.

Firmware 107

Firmware Passwords Authentication Wireless 107

Daniel Miessler

MAY 14, 2020

Use unique, strong passwords, and store them in a password manager. Many people get hacked from having guessable or previously compromised passwords. Good passwords are long, random, and unique to each account, which means it’s impossible for a human to manage them on their own. Everything.

Risk 345

Risk Password Management Passwords Accountability 345

Security Affairs

SEPTEMBER 8, 2020

Researchers found multiple vulnerabilities in MoFi Network routers, including critical flaws that can be exploited to remotely hack a device. “The authentication function contains undocumented code which provides the ability to authenticate as root without having to know the actual root password. Pierluigi Paganini.

Firmware 82

Firmware Wireless Authentication Advertising 82

Security Affairs

MAY 25, 2021

Trend Micro fixed some flaws in Trend Micro Home Network Security devices that could be exploited to elevate privileges or achieve arbitrary authentication. Trend Micro fixed three vulnerabilities in Home Network Security devices that could be exploited to elevate privileges or achieve arbitrary authentication. Pierluigi Paganini.

Network Security 111

Network Security Authentication Firmware Passwords 111

Security Affairs

JULY 16, 2018

A security researcher discovered that the IoT search engine ZoomEye has cached login passwords for tens of thousands of Dahua DVRs. The IoT search engine ZoomEye has cached login passwords for tens of thousands of Dahua DVRs, the discovery was made by security researcher Ankit Anubhav, Principal Researcher at NewSky Security.

IoT 55

IoT Engineering Passwords Firmware 55

Security Affairs

DECEMBER 24, 2018

The communications are not encrypted, however the WiFi password is sent encrypted during set up (albeit trivial to decrypt).” ” Once the mobile app has discovered the IP address of the lights, it authenticates with them, receives an authentication token and retrieves information about the device. .”

IoT 76

IoT Hacking DNS Authentication 76

Malwarebytes

APRIL 13, 2022

On April 9, hacking group BlueHornet tweeted about an experimental exploit for NGINX 1.18 Specifically, the NGINX LDAP reference implementation which uses LDAP to authenticate users of applications being proxied by NGINX. LDAP can also tackle authentication, so users can sign on just once and access many different files on the server.

Authentication 100

Authentication IoT Password Management Firmware 100

SecureList

JUNE 8, 2022

Routers are forever being hacked and infected, and used to infiltrate local networks. According to a survey by UK company Broadband Genie, 48% of users had not changed any of their router’s settings at all , even the control panel and Wi-Fi network passwords. search results for “default password” in June 2021.

DDOS 95

DDOS Passwords IoT Firmware 95

Troy Hunt

NOVEMBER 25, 2020

I also looked at custom firmware and soldering and why, to my mind, that was a path I didn't need to go down at this time. I can't blame this on the teddy bears themselves, rather the fact that the MongoDB holding all the collected data was left publicly facing without a password. IoT firmware should be self-healing.

IoT 357

IoT Firmware Risk Manufacturing 357

eSecurity Planet

MARCH 3, 2023

The protocol protects your incoming and outgoing internet traffic and makes it difficult for cyber criminals to intercept your data or hack your device. The typical username and password for Wi-Fi routers is “admin” for both, but you may need to search online or contact your ISP if that doesn’t work.

Wireless 98

Wireless Encryption Passwords IoT 98

eSecurity Planet

OCTOBER 24, 2023

Secure practices like robust admin passwords and advanced encryption ensure control over traffic, safeguarding personal information and increasing the odds of a secure online experience. Proper home router practices , such as enabling encryption settings and providing strong default admin passwords, will dramatically improve network security.

Malware 120

Malware Antivirus Software Passwords 120

eSecurity Planet

NOVEMBER 4, 2021

CWE-1277 : Firmware Not Updateable – firmware exploitation exposes the victim to a permanent risk without any possibility to patch weaknesses. Hackers may use firmware exploitation to compromise the network, as the firmware links the operating system and the hardware. The most popular firmware is BIOS and UEFI.

Software 114

Software Firmware Computers and Electronics Risk 114

Security Affairs

FEBRUARY 3, 2020

“ Attackers can easily obtain default passwords and identify internet-connected target systems. Passwords can be found in p roduct documentation and compiled lists available on the Internet.” SecurityAffairs – NSC Linear eMerge E3 , hacking). ” reads the advisory p ublished by Applied Risk. 06 and older.

DDOS 73

DDOS Hacking Internet Internet 73

Security Affairs

MARCH 16, 2022

In order to compromise the target network, the attackers conducted a brute-force password guessing attack against an un-enrolled and inactive account. Update software, including operating systems, applications, and firmware on IT network assets in a timely manner. Require all accounts with password logins (e.g.,

Accountability 88

Accountability Passwords Authentication Firmware 88

Security Affairs

APRIL 26, 2019

An attacker could chain the issues to steal password theft and possibly remotely compromise the devices, he only needs to know the IP address of the P2P server used by the device. Furthermore, even if software patches were issued, the likelihood of most users updating their device firmware is low. ” reported Brian Krebs.

IoT 79

IoT Hacking Manufacturing Advertising 79

Pen Test

OCTOBER 12, 2023

Countermeasures: To prevent drone signal hijacking, drone manufacturers and operators can implement encryption and authentication mechanisms for RF communication. What are the common firmware and software vulnerabilities in RF devices that can be exploited? Strong, complex passwords are essential to prevent unauthorized access.

Encryption 52

Encryption Firmware Surveillance Technology 52

Security Affairs

MARCH 22, 2023

. “An attacker can make an authenticated HTTP request to trigger this vulnerability.” The user needs to authenticate into the mesh system first, meaning they’d need to access an unprotected network or the login credentials of a password-protected network, for this attack to be successful. on January 19, 2023.

Wireless 85

Wireless Firmware Authentication Passwords 85

Security Affairs

JANUARY 27, 2020

An attacker with this key can successfully authenticate as this user to the FortiSIEM Supervisor.” While the user’s shell is limited to running the /opt/phoenix/phscripts/bin/tunnelshell script, SSH authentication still succeeds.”. SecurityAffairs – Fortinet, hacking). reads the security advisory. reads the advisory.

Advertising 107

Advertising Firmware Authentication Passwords 107

Security Affairs

OCTOBER 26, 2021

Below are the recommended mitigations included in the alert: Implement regular backups of all data to be stored as air gapped, password protected copies offline. Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Use double authentication when logging into accounts or services.

Ransomware 122

Ransomware Firmware Antivirus Accountability 122

Security Affairs

MARCH 19, 2022

Regularly back up data, password protect backup copies offline. Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Use multifactor authentication where possible. Avoid reusing passwords for multiple accounts. SecurityAffairs – hacking, AvosLocker ransomware).

Ransomware 92

Ransomware DDOS Passwords Backups 92

Security Affairs

SEPTEMBER 3, 2021

The FBI provided the following mitigations to protect against ransomware attacks: Regularly back up data, air gap, and password protect backup copies offline. Install updates/patch operating systems, software, and firmware as soon as they are released. Use multifactor authentication with strong pass phrases where possible.

Ransomware 91

Ransomware Passwords Backups Firmware 91

Security Boulevard

NOVEMBER 10, 2022

The industrial automation giant ABB addressed the flaw with the release of firmware updates on July 14, 2022. The researchers initially discovered an authentication bypass issue, then explored the systems looking at functionalities available to authenticated users such as uploading and downloading configuration files.

Firmware 98

Firmware Authentication Passwords Manufacturing 98

Security Affairs

APRIL 25, 2022

Regularly back up data, air gap, and password-protect backup copies offline. Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Use multifactor authentication where possible. Implement the shortest acceptable timeframe for password changes. To nominate, please visit:?

Ransomware 98

Ransomware Antivirus Passwords Malware 98

Security Affairs

JULY 28, 2020

CGI password logger This installs a fake version of the device admin login page, logging successful authentications and passing them to the legitimate login page. The experts observed that once a device has been infected, the malicious code can prevent the installation of firmware updates. Pierluigi Paganini.

Malware 100

Malware Firmware Advertising Manufacturing 100

eSecurity Planet

MARCH 1, 2023

To prevent unwanted access and protect data in transit, wireless connections must be secured with strong authentication procedures, encryption protocols, access control rules, intrusion detection and prevention systems, and other security measures. As a result, wireless networks are prone to eavesdropping, illegal access and theft.

Wireless 98

Wireless Encryption Authentication IoT 98

Security Affairs

APRIL 23, 2021

The malware moves all files stored on the device to password-protected 7zip archives and demand the payment of a $550 ransom. The vendor recommends the use of strong passwords and to modify the default network port 8080 for accessing the NAS operating interface. SecurityAffairs – hacking, QNAP NAS). “QNAP® Systems, Inc.

Ransomware 112

Ransomware Backups Media Malware 112