Siemens Scalance w1750d Firmware vulnerabilities

62 CVEs affecting Siemens Scalance w1750d Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-37896, published 2022-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-14491, published 2017-10-04. Critical severity, CVSS 9.8. EPSS: 84.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
CVE-2021-25156, published 2021-03-30. Medium severity, CVSS 4.9. EPSS: 39.7% chance of exploitation in the next 30 days. A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x:…
CVE-2021-25158, published 2021-03-30. Medium severity, CVSS 5.9. EPSS: 30.5% chance of exploitation in the next 30 days. A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and…
CVE-2017-13099, published 2017-12-13. Medium severity, CVSS 5.9. EPSS: 27.4% chance of exploitation in the next 30 days. wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL…
CVE-2021-25162, published 2021-03-30. High severity, CVSS 8.1. EPSS: 25.8% chance of exploitation in the next 30 days. A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant…
CVE-2002-20001, published 2021-11-11. High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days. The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE…
CVE-2021-25161, published 2021-03-30. Medium severity, CVSS 6.1. EPSS: 16.4% chance of exploitation in the next 30 days. A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x:…
CVE-2021-25159, published 2021-03-30. Medium severity, CVSS 6.5. EPSS: 12.6% chance of exploitation in the next 30 days. A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant…
CVE-2021-25155, published 2021-03-30. Medium severity, CVSS 6.5. EPSS: 12.4% chance of exploitation in the next 30 days. A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant…
CVE-2021-25157, published 2021-03-30. Medium severity, CVSS 4.9. EPSS: 10.3% chance of exploitation in the next 30 days. A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x:…

Latest

CVE-2022-37896, published 2022-10-07. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface.…
CVE-2022-37895, published 2022-10-07. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the…
CVE-2022-37894, published 2022-10-07. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the…
CVE-2022-37893, published 2022-10-07. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute…
CVE-2022-37892, published 2022-10-07. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of…
CVE-2022-37891, published 2022-10-07. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the…
CVE-2022-37890, published 2022-10-07. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the…
CVE-2022-37889, published 2022-10-07. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba…
CVE-2022-37887, published 2022-10-07. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba…
CVE-2022-37886, published 2022-10-07. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba…