NVD disclosure day
CVE-2024-55160
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
GFast versions 2 through 3.2 contain a SQL injection vulnerability in the OrderBy parameter, allowing unauthenticated attackers to execute arbitrary SQL commands. This could lead to unauthorized access or modification of system operational logs, potentially impacting service integrity.
CVE-2024-51139
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical buffer overflow vulnerability exists in multiple DrayTek Vigor router models, allowing remote attackers to execute arbitrary code by sending specially crafted HTTP POST requests. This could compromise the router's functionality and the network it protects.
CVE-2024-51138
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A stack-based buffer overflow in the TR-069 STUN server's URL parsing function allows remote attackers to execute arbitrary code with elevated privileges by sending a crafted request. This vulnerability affects various DrayTek Vigor router models due to insufficient bounds checking on URL parameters.
CVE-2024-10918
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A stack-based buffer overflow vulnerability exists in the libmodbus library, allowing an attacker to disrupt operations or gain unauthorized access by sending specially crafted requests with unexpected lengths. This could impact system integrity and availability.
CVE-2025-21796
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A use-after-free vulnerability exists in the Linux kernel's NFS service, potentially causing system instability. This occurs when an error during access control list retrieval leads to improper memory handling. Affected systems running the Linux kernel may be at risk if the NFS service is reachable.