AiLux vulnerabilities
We track 8 vulnerabilities in AiLux products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on March 5, 2024.
Latest AiLux vulnerabilities
- 9.8 Critical severity
imx6 bundle: Product Released in Non-Release Configuration
A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application (due to the “debug” configuration parameter set to “True”) allows a remote unauthenticated attacker to access critical information
- 9.8 Critical severity
A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the…
A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
- 8.8 High severity
imx6 bundle: Unrestricted Upload of File with Dangerous Type
A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiL
- 9.0 Critical severity
imx6 bundle: Improper Neutralization of Formula Elements in a CSV File
A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerning the function “export_file”) allows a remote authenticated attacker to inject arbitrary formulas in
- 8.8 High severity
imx6 bundle: Unrestricted Upload of File with Dangerous Type
A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux im
- 9.8 Critical severity
imx6 bundle: Execution with Unnecessary Privileges
A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” option and with root privileges) exacerbates the impacts of successful attacks executed against the brows
- 8.8 High severity
imx6 bundle: Out-of-bounds Write
A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service (DoS) condit
- 9.8 Critical severity
imx6 bundle: Use of Hard-coded Credentials
A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all included data with the same privileges of the web application. This issue aff