I-O DATA DEVICE vulnerabilities
We track 8 vulnerabilities in I-O DATA DEVICE products across 15 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2025.
Latest I-O DATA DEVICE vulnerabilities
- 8.4 High severity
NarSuS App: Unquoted Search Path or Element
Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
- 7.2 High severity
WN-7D36QR: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.
- 9.8 Critical severity
HDL-TC1: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthen
- 7.2 High severity
UD-LT2: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a
- 7.5 High severity
UD-LT2: Inclusion of Undocumented Features or Chicken Bits
Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports.
- 7.2 High severity
UD-LT2: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a
- 7.5 High severity
UD-LT1: Inclusion of Undocumented Features or Chicken Bits
Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS co
- 7.2 High severity
UD-LT1: Improper Neutralization of Special Elements used in an OS Command
UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to execute arbitrary OS commands.