Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

CVEs (80)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-3843 1Wago 1852 111/000 001 Firmware Jun 17, 2026 Feb 16, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of paramete...Show more In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters. Show less
CVE-2022-47767 1Solar Log 9Solar Log 1000 Firmware Solar Log 1000 Pm+ FirmwareSolar Log 1200 Firmware+6 more Jun 17, 2026 Jan 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 (included)...Show more A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 (included). This does not exist in SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 / 6.0.0 for SL Base.Show less
CVE-2023-22316 1Pixela 1Pix Rt100 Firmware Jun 17, 2026 Jan 17, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker to access the product via undocumented Telnet or SSH services.
CVE-2022-46997 1Passhunt Project 1Passhunt Jun 17, 2026 Dec 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital c...Show more Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.Show less
CVE-2022-46996 1Vsphere Selfuse Project 1Vsphere Selfuse Jun 17, 2026 Dec 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and di...Show more vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.Show less
CVE-2022-3203 1Oringnet 1Iap 420+ Firmware Jun 17, 2026 Oct 21, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative sh...Show more On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.Show less
CVE-2022-1741 1Dominionvoting 1Imagecast X Jun 17, 2026 Jun 24, 2022 N/A· v4 6.8 MEDIUM· v3 7.2 HIGH· v2 The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileges on a device and/or install malicious code.
CVE-2017-20084 1Jung Group 1Smart Visu Server Firmware Nov 21, 2024 Jun 22, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation...Show more A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2017-20083 1Jung Group 1Smart Visu Server Firmware Nov 21, 2024 Jun 22, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack h...Show more A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2017-20082 1Jung Group 1Smart Visu Server Firmware Nov 21, 2024 Jun 22, 2022 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. This issue affects some unknown processing. The manipulation leads to backdoor. The attack needs to...Show more A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. This issue affects some unknown processing. The manipulation leads to backdoor. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2021-4229 1Ua Parser Js Project 1Ua Parser Js Jun 17, 2026 May 24, 2022 N/A· v4 8.8 HIGH· v3 7.6 HIGH· v2 A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is abl...Show more A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2021-24867 1Accesspressthemes 93Accessbuddy Accesspress LiteAccesspress Mag+90 more Jun 17, 2026 Feb 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those ho...Show more Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusionShow less
CVE-2021-43987 1Myscada 1Mypro Jun 17, 2026 Dec 23, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface.
CVE-2020-28593 1Cosori 1Cs158 Af Firmware Jun 17, 2026 Apr 15, 2021 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious...Show more A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.Show less
CVE-2021-25371 1Samsung 1Android Jun 17, 2026 Mar 26, 2021 N/A· v4 6.7 MEDIUM· v3 7.2 HIGH· v2 A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
CVE-2020-3352 1Cisco 1Firepower Threat Defense Jun 17, 2026 Oct 21, 2020 N/A· v4 5.5 MEDIUM· v3 1.9 LOW· v2 A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration c...Show more A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access.Show less
CVE-2020-12504 3Korenix Pepperl FuchsWestermo 29Es7506 Firmware Es7510 Xt FirmwareEs7510 Firmware+26 more Jun 17, 2026 Oct 15, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and...Show more Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.Show less
CVE-2020-16204 1Redlion 2N Tron 702 W Firmware N Tron 702m12 W Firmware Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions).
CVE-2020-14487 1Freemedsoftware 1Openclinic Ga Jun 17, 2026 Jul 29, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.
CVE-2018-17919 1Xiongmaitech 1Xmeye P2p Cloud Server Nov 21, 2024 Oct 10, 2018 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.

Previous 1 2 34