Welotec PSIRT
organization01
references
Other names and identifiers for this entity.
welotec_psirtDE psirt@welotec.com
02
assessed vulnerabilities (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41714US | — | — | ||
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload… | ||||
| CVE-2025-41702US | —OT elevated | — | ||
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authent… | ||||
| CVE-2024-6387US | high8.1 | Exploit | ||
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauth… | ||||
| CVE-2024-3911US | — | — | ||
An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.
| ||||
| CVE-2023-1083US | —OT elevated | — | ||
An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. | ||||
| CVE-2023-1082US | — | — | ||
An remote attacker with low privileges can perform a command injection which can lead to root access. | ||||