Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Kali Linux 2025.2 released with 13 new tools, car hacking updates

Source: https://www.bleepingcomputer.com/news/security/kali-linux-20252-released-with-13-new-tools-car-hacking-updates/

Kali Linux 2025.2 is the latest release of the well-known penetration testing and ethical hacking Linux distribution. This update introduces 13 new tools, with a particular emphasis on enhancements related to car hacking capabilities. Kali Linux is widely used by cybersecurity professionals, researchers, and threat actors alike for vulnerability assessment, exploitation, and security testing. The addition of new tools expands the arsenal available for security testing, potentially including utilities for automotive security research, which targets vulnerabilities in vehicle electronic systems such as CAN bus networks, infotainment systems, and telematics. While Kali Linux itself is not a vulnerability, the release of new tools can influence the threat landscape by enabling more sophisticated or accessible exploitation techniques. The update does not indicate any direct vulnerabilities or exploits within Kali Linux itself, nor are there known exploits in the wild tied to this release. However, the inclusion of car hacking tools highlights the growing focus on automotive cybersecurity, an area of increasing concern due to the proliferation of connected vehicles. The release is newsworthy due to its recent publication, the trusted source (bleepingcomputer.com), and its relevance to the InfoSec community. There is minimal discussion currently on Reddit, suggesting early awareness but limited immediate impact reports.

Detailed information about Kali Linux 2025.2 released with 13 new tools, car hacking updates. Get real-time updates, technical details, and mitigation strategie

Kali Linux 2025.2 released with 13 new tools, car hacking updates - Live Threat Intelligence - Threat Radar | OffSeq.com

Kali Linux 2025.2 released with 13 new tools, car hacking updates

Reddit Discussion: Kali Linux 2025.2 released with 13 new tools, car hacking updates

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows an unauthenticated remote attacker to read files from the system’s file structure.

CVE-2025-25265 is a high-severity vulnerability affecting the WAGO CC100 0751-9x01 controller, a device commonly used in industrial automation and control systems. The vulnerability arises from a missing authentication mechanism on a critical web application endpoint used for configuring the controller. Specifically, the web interface exposes an unauthenticated endpoint that allows remote attackers to read arbitrary files from the system's file structure. This lack of access control (classified under CWE-306: Missing Authentication for Critical Function) means that any attacker with network access to the device's web interface can retrieve sensitive files without needing credentials or user interaction. The vulnerability has a CVSS v3.1 base score of 7.5, reflecting its ease of exploitation (network accessible, no privileges or user interaction required) and the high impact on confidentiality, as attackers can access potentially sensitive configuration files or other data stored on the device. However, the vulnerability does not affect integrity or availability directly. No known exploits are currently reported in the wild, and no patches have been published at the time of analysis. Given the nature of industrial controllers, unauthorized file disclosure can lead to exposure of operational parameters, credentials, or proprietary information, which could be leveraged for further attacks or industrial espionage. The vulnerability affects version 0.0.0 of the product, which likely indicates all currently deployed versions prior to patching are vulnerable. The web application is accessible at a specific path, which may be discoverable via network scanning or fingerprinting tools, increasing the risk of targeted attacks. Overall, this vulnerability represents a significant risk to the confidentiality of data on affected WAGO controllers due to missing authentication controls on critical configuration functions accessible remotely over the network.

Detailed information about CVE-2025-25265: CWE-306 Missing Authentication for Critical Function in WAGO WAGO CC100 0751-9x01 affecting WAGO WAGO CC100 0751-9x01

CVE-2025-25265: CWE-306 Missing Authentication for Critical Function in WAGO WAGO CC100 0751-9x01 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-25265: CWE-306 Missing Authentication for Critical Function in WAGO WAGO CC100 0751-9x01

An unauthenticated remote attacker can take advantage of the current overly permissive CORS policy to gain access and read the responses, potentially exposing sensitive data or enabling further attacks.

CVE-2025-25264 is a high-severity vulnerability affecting the WAGO CC100 0751-9x01 product, specifically related to an overly permissive Cross-Origin Resource Sharing (CORS) policy. The vulnerability is classified under CWE-942, which pertains to permissive cross-domain policies that allow untrusted domains to access resources. In this case, the device's CORS configuration does not properly restrict which external domains can interact with it, enabling an unauthenticated remote attacker to exploit this misconfiguration. By leveraging the permissive CORS policy, the attacker can issue cross-origin requests and read sensitive responses from the device, potentially exposing confidential information or enabling further attack vectors such as session hijacking, data exfiltration, or manipulation of device behavior. The vulnerability requires no user interaction and no authentication, making it easier to exploit remotely over the network. The CVSS 3.1 score of 8.8 reflects the critical impact on confidentiality, integrity, and availability, with low attack complexity and no privileges required. Although no known exploits have been reported in the wild yet, the nature of the vulnerability and the affected product's role in industrial automation and control systems (ICS) make it a significant risk. The lack of available patches at the time of publication further increases the urgency for mitigation and risk management.

Detailed information about CVE-2025-25264: CWE-942 Permissive Cross-domain Policy with Untrusted Domains in WAGO CC100 0751-9x01 affecting WAGO CC100 0751-9x01.

CVE-2025-25264: CWE-942 Permissive Cross-domain Policy with Untrusted Domains in WAGO CC100 0751-9x01 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-25264: CWE-942 Permissive Cross-domain Policy with Untrusted Domains in WAGO CC100 0751-9x01

A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-6110 is a critical security vulnerability identified in the Tenda FH1201 router, specifically in firmware version 1.2.0.14(408). The vulnerability arises from a stack-based buffer overflow condition triggered by improper handling of the 'page' argument in the /goform/SafeMacFilter endpoint. This endpoint is likely part of the router's web management interface responsible for MAC address filtering functionality. An attacker can remotely send a specially crafted request to this endpoint without requiring user interaction or prior authentication, exploiting the buffer overflow to potentially execute arbitrary code on the device. The vulnerability is remotely exploitable over the network, increasing its risk profile. The CVSS 4.0 score is 8.7 (high severity), reflecting the ease of exploitation (network vector, low complexity), no privileges or user interaction required, and the high impact on confidentiality, integrity, and availability. While no public exploits are currently known in the wild, the disclosure of the exploit code means that threat actors could develop weaponized attacks quickly. The lack of available patches or vendor advisories at this time further exacerbates the risk. The vulnerability affects only the specified firmware version, but given the popularity of Tenda routers in consumer and small business environments, the attack surface is significant. Successful exploitation could allow attackers to take full control of the router, intercept or manipulate network traffic, pivot to internal networks, or cause denial of service conditions by crashing the device.

Detailed information about CVE-2025-6110: Stack-based Buffer Overflow in Tenda FH1201 affecting Tenda FH1201. Get real-time updates, technical details, and miti

CVE-2025-6110: Stack-based Buffer Overflow in Tenda FH1201 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6110: Stack-based Buffer Overflow in Tenda FH1201

A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-6098 is a critical buffer overflow vulnerability identified in the UTT 进取 750W device, specifically affecting version 5.0 of its firmware. The flaw resides in the strcpy function within the /goform/setSysAdm API endpoint, where improper handling of the passwd1 argument allows an attacker to overflow the buffer. This vulnerability can be exploited remotely without requiring any authentication or user interaction, making it highly accessible to attackers. The buffer overflow can lead to arbitrary code execution, potentially allowing an attacker to take full control of the affected device, compromise its confidentiality, integrity, and availability, or cause denial of service. The vulnerability has a CVSS 4.0 base score of 9.3, reflecting its critical severity, with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The impact on confidentiality, integrity, and availability is high (VC:H, VI:H, VA:H). Although the vendor was notified early, no patch or mitigation has been released, and the exploit details have been publicly disclosed, increasing the risk of exploitation. No known exploits in the wild have been reported yet, but the public disclosure and ease of exploitation make this a significant threat to any organization using the affected product. The UTT 进取 750W is likely a network or industrial device given the API context, and its compromise could lead to broader network infiltration or operational disruption.

Detailed information about CVE-2025-6098: Buffer Overflow in UTT 进取 750W affecting UTT 进取 750W. Get real-time updates, technical details, and mitigation strateg

CVE-2025-6098: Buffer Overflow in UTT 进取 750W - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6098: Buffer Overflow in UTT 进取 750W

A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-6097 is a vulnerability identified in the UTT 进取 750W device, specifically affecting version 5.0 of its firmware. The flaw resides in the Administrator Password Handler component, within the function formDefineManagement of the /goform/setSysAdm endpoint. The vulnerability arises due to improper validation of the passwd1 argument, which allows an attacker to change the administrator password without any verification. This means that an unauthenticated remote attacker can manipulate the password parameter to reset the administrator password, effectively gaining administrative access to the device. The vulnerability is remotely exploitable over the network without requiring any privileges or user interaction, increasing its risk profile. Although the vendor was notified early, there has been no response or patch released as of the publication date (June 16, 2025). The CVSS v4.0 base score is 6.9, categorized as medium severity, reflecting the ease of exploitation (network vector, no authentication, no user interaction) but limited impact on confidentiality and availability. The vulnerability does not directly impact confidentiality or availability but compromises integrity by allowing unauthorized administrative control, which can lead to further malicious activities such as configuration changes, network interception, or persistent backdoors. No known exploits are currently observed in the wild, but public disclosure of the exploit code increases the likelihood of exploitation attempts. The lack of vendor response and patch availability heightens the urgency for affected organizations to implement mitigations.

Detailed information about CVE-2025-6097: Unverified Password Change in UTT 进取 750W affecting UTT 进取 750W. Get real-time updates, technical details, and mitigat

CVE-2025-6097: Unverified Password Change in UTT 进取 750W - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6097: Unverified Password Change in UTT 进取 750W

AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if 
exploited, could allow an authenticated user to shut down certain 
necessary PI Data Archive subsystems, resulting in a denial of service. 
Depending on the timing of the crash, data present in snapshots/write 
cache may be lost.

CVE-2025-44019 is a high-severity vulnerability affecting AVEVA PI Data Archive products. The root cause is an uncaught exception (classified under CWE-248: Uncaught Exception) that can be triggered by an authenticated user. Exploitation of this flaw allows the attacker to forcibly shut down critical subsystems within the PI Data Archive environment. This shutdown leads to a denial of service (DoS) condition, disrupting the availability of the data archive services. Furthermore, the timing of the induced crash is critical; if it occurs during snapshot creation or while data is being written to cache, there is a risk of data loss, impacting data integrity and availability. The vulnerability requires low attack complexity (AC:L) and privileges (PR:L), meaning an attacker must be authenticated but no special privileges beyond that are necessary. No user interaction is required to exploit the vulnerability. The scope is unchanged, affecting only the vulnerable component. The CVSS v3.1 base score is 7.1, reflecting high severity primarily due to the impact on availability and integrity, while confidentiality is not affected. No known exploits are currently in the wild, and no patches have been published yet. The vulnerability was reserved in April 2025 and published in June 2025, indicating recent discovery and disclosure. AVEVA PI Data Archive is widely used in industrial environments for real-time data management, especially in sectors such as manufacturing, energy, utilities, and critical infrastructure, making this vulnerability particularly relevant to operational technology (OT) environments.

Detailed information about CVE-2025-44019: CWE-248 in AVEVA PI Data Archive affecting AVEVA PI Data Archive. Get real-time updates, technical details, and mitig

CVE-2025-44019: CWE-248 in AVEVA PI Data Archive - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-44019: CWE-248 in AVEVA PI Data Archive

A cross-site scripting vulnerability exists in 
AVEVA PI Connector for CygNet 
Versions 1.6.14 and prior that, if exploited, could allow an 
administrator miscreant with local access to the connector admin portal 
to persist arbitrary JavaScript code that will be executed by other 
users who visit affected pages.

CVE-2025-4417 is a cross-site scripting (XSS) vulnerability identified in AVEVA PI Connector for CygNet, specifically affecting versions 1.6.14 and earlier. This vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation, allowing injection of malicious scripts. The flaw permits an attacker with administrator-level privileges and local access to the connector's administrative portal to inject and persist arbitrary JavaScript code. This malicious script is then executed in the browsers of other users who access the affected pages, potentially enabling session hijacking, credential theft, or unauthorized actions performed in the context of the victim's session. The vulnerability requires high privileges (administrator access) and user interaction (visiting the compromised page) to be exploited. The CVSS v3.1 base score is 5.5 (medium severity), reflecting limited attack vector (local access), low complexity, and the impact primarily on integrity, with no direct confidentiality or availability impact. The vulnerability's scope is considered changed (S:C) because the injected script affects other users beyond the initial attacker. No known exploits have been reported in the wild, and no patches or mitigations have been officially published at the time of analysis. The AVEVA PI Connector for CygNet is a specialized industrial control system (ICS) integration product used to connect CygNet SCADA data with AVEVA PI System, commonly deployed in critical infrastructure sectors such as energy, utilities, and manufacturing.

Detailed information about CVE-2025-4417: CWE-79 in AVEVA PI Connector for CygNet affecting AVEVA PI Connector for CygNet. Get real-time updates, technical deta

CVE-2025-4417: CWE-79 in AVEVA PI Connector for CygNet - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4417: CWE-79 in AVEVA PI Connector for CygNet

The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.

CVE-2025-49200 is a vulnerability identified in all versions of SICK AG's product 'SICK Field Analytics.' The core issue stems from the application's handling of backup files, which are created and stored without encryption. This lack of encryption means that sensitive information contained within these backups can be accessed by unauthorized actors if they manage to download and decompress these files. The vulnerability is classified under CWE-200, indicating an exposure of sensitive information to unauthorized parties. Technically, the vulnerability allows an attacker with network access and low privileges (as indicated by the CVSS vector AV:N/AC:L/PR:L/UI:N) to remotely retrieve backup files without requiring user interaction. The vulnerability impacts confidentiality significantly (C:H), but does not affect integrity or availability (I:N/A:N). The scope is unchanged (S:U), meaning the impact is limited to the vulnerable component itself. Although no known exploits are currently reported in the wild, the medium CVSS score of 6.5 reflects a moderate risk primarily due to the ease of exploitation (network accessible, low complexity) and the high confidentiality impact. The vulnerability is particularly concerning because backup files often contain comprehensive datasets, including operational analytics, potentially sensitive configuration data, or personally identifiable information (PII), which if exposed, could lead to privacy violations, competitive intelligence leaks, or compliance breaches.

Detailed information about CVE-2025-49200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in SICK AG SICK Field Analytics affecting SICK AG 

CVE-2025-49200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in SICK AG SICK Field Analytics - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in SICK AG SICK Field Analytics

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring  the  services  in  a  way  that  they  are  unable  to  run,  making  the  application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.

CVE-2025-49199 is a high-severity vulnerability affecting all versions of SICK AG's SICK Field Analytics product. The root cause is insufficient verification of data authenticity (CWE-345) related to the handling of backup ZIP files. Specifically, the application does not cryptographically sign these backup ZIPs, which allows an attacker with some level of access (requires privileges) to download a backup, modify its contents, and re-upload it without detection. By tampering with the backup configuration files, an attacker can disrupt the normal operation of the application by misconfiguring services so they fail to run, rendering the application unusable. Additionally, the attacker can redirect internal traffic to attacker-controlled services, enabling interception and exfiltration of sensitive data. The CVSS v3.1 score of 8.8 reflects a high impact on confidentiality, integrity, and availability, with network vector (AV:N), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits are currently reported in the wild, and no patches have been published yet. This vulnerability poses a significant risk to organizations relying on SICK Field Analytics for industrial or operational analytics, especially where the integrity and availability of analytics services are critical for operational decision-making and safety. The ability to redirect internal traffic also raises concerns about data leakage and potential lateral movement within networks.

Detailed information about CVE-2025-49199: CWE-345 Insufficient Verification of Data Authenticity in SICK AG SICK Field Analytics affecting SICK AG SICK Field A

CVE-2025-49199: CWE-345 Insufficient Verification of Data Authenticity in SICK AG SICK Field Analytics - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Affecting Czech Republic

Filter Threats

Threats Affecting Czech Republic