Filtered by vendor Circutor Subscriptions
Total 8 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-8891 1 Circutor 1 Circutor Q Smt 2024-09-18 5.3 Medium
An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4.
CVE-2024-8887 1 Circutor 1 Circutor Q Smt 2024-09-18 10 Critical
CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device.
CVE-2024-8888 1 Circutor 1 Circutor Q Smt 2024-09-18 10 Critical
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
CVE-2024-8889 1 Circutor 1 Circutor Tcp2rs Plus 2024-09-18 9.3 Critical
Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.
CVE-2022-1669 1 Circutor 2 Compact Dc-s Basic, Compact Dc-s Basic Firmware 2024-09-17 6.8 Medium
A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to offer a management web application. Once authenticated with valid credentials in this web portal, a potential attacker could submit any "Address" value and it would be copied to a second variable with a "strcpy" vulnerable function without checking its length. Because of this, it is possible to send a long address value to overflow the process stack, controlling the function return address.
CVE-2021-33842 1 Circutor 2 Sge-plc1000, Sge-plc1000 Firmware 2024-09-16 8.8 High
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.
CVE-2021-33841 1 Circutor 2 Sge-plc1000, Sge-plc1000 Firmware 2024-09-16 10 Critical
SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges.
CVE-2021-26777 1 Circutor 2 Compact Dc-s Basic, Compact Dc-s Basic Firmware 2024-08-03 9.8 Critical
Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare version CIR_CDC_v1.2.17, allows attackers to execute arbitrary code.