Viloliving vulnerabilities
We track 6 vulnerabilities in Viloliving products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2024.
Latest Viloliving vulnerabilities
- 9.1 Critical severity
vilo_5_mesh_wifi_system_firmware: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.
- 9.6 Critical severity
vilo_5_mesh_wifi_system_firmware: Missing Authentication for Critical Functionality
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.
- 9.6 Critical severity
vilo_5_mesh_wifi_system_firmware: Buffer Copy without Checking Size of Input
A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length.
- 9.6 Critical severity
vilo_5_mesh_wifi_system_firmware: Buffer Copy without Checking Size of Input
A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoe_username and pppoe_password fields being larger than 128 bytes in leng
- 9.6 Critical severity
vilo_5_mesh_wifi_system_firmware: Buffer Copy without Checking Size of Input
A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths.
- 9.6 Critical severity
vilo_5_mesh_wifi_system_firmware: Buffer Copy without Checking Size of Input
A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffe