Nexo Cordless Nutrunner Nxa030S 36V (0608842002)

The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.

Published: 2024-01-10T13:10:15.503Z
Updated: 2025-06-17T20:59:15.373Z

The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.

Published: 2024-01-10T13:09:46.605Z
Updated: 2025-06-17T20:59:15.232Z

The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.

Published: 2024-01-10T13:09:10.347Z
Updated: 2025-04-17T15:48:37.330Z

The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.

Published: 2024-01-10T13:08:37.557Z
Updated: 2025-06-17T20:59:15.081Z

The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.

Published: 2024-01-10T13:08:03.996Z
Updated: 2025-06-17T20:59:14.930Z

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.

Published: 2024-01-10T13:07:22.893Z
Updated: 2025-06-03T14:28:07.088Z

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.

Published: 2024-01-10T13:06:48.658Z
Updated: 2025-06-17T20:59:14.784Z

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.

Published: 2024-01-10T13:05:41.881Z
Updated: 2025-06-17T20:59:14.559Z

The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session.

Published: 2024-01-10T13:05:08.294Z
Updated: 2025-06-17T20:59:14.356Z

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.

Published: 2024-01-10T13:04:36.606Z
Updated: 2025-06-17T20:59:14.230Z

The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.

Published: 2024-01-10T13:04:04.926Z
Updated: 2025-06-17T20:59:14.100Z

The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.

Published: 2024-01-10T13:03:32.151Z
Updated: 2025-06-17T20:59:13.975Z

The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.

Published: 2024-01-10T13:02:51.682Z
Updated: 2025-06-17T20:59:13.843Z

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.

Published: 2024-01-10T13:02:19.652Z
Updated: 2025-06-17T20:59:13.701Z

The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.

Published: 2024-01-10T13:01:35.579Z
Updated: 2025-06-17T20:59:13.576Z

The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.

Published: 2024-01-10T13:00:29.554Z
Updated: 2025-06-17T20:59:13.437Z

The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.

Published: 2024-01-10T10:43:24.818Z
Updated: 2025-06-17T20:59:13.277Z

The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.

Published: 2024-01-10T10:42:03.673Z
Updated: 2025-06-17T20:59:13.141Z

The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file.

Published: 2024-01-10T10:41:20.413Z
Updated: 2025-06-17T20:59:13.000Z

The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.

Published: 2024-01-10T10:40:20.260Z
Updated: 2025-06-17T20:59:12.865Z

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.

Published: 2024-01-10T10:39:30.602Z
Updated: 2025-06-17T20:59:12.689Z

The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.

Published: 2024-01-10T10:38:46.846Z
Updated: 2025-06-17T20:59:12.535Z

The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.

Published: 2024-01-10T10:37:55.300Z
Updated: 2025-06-17T20:59:12.411Z

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.

Published: 2024-01-10T10:36:56.971Z
Updated: 2025-06-17T20:59:12.299Z

The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.

Published: 2024-01-10T10:35:25.216Z
Updated: 2025-06-17T20:59:12.176Z