CWE-1242 vulnerabilities

7 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.7	EPSS 0.2%	CVE-2026-82928F&F Filipowski mH-DEVELOPER · Inclusion of Undocumented Features or Chicken Bits High7.7EPSS 0.2%2026-09-28CVE Database V5CVE-2026-82928 mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30 EPSS 0.2%Vulnerability CWE-1242	CVE Database V5	2026-09-28
High	8.1	EPSS 0.3%	CVE-2025-41756MBS UBR-01 Mk II · Inclusion of Undocumented Features or Chicken Bits High8.1EPSS 0.3%2026-03-09CVE Database V5CVE-2025-41756 A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system. EPSS 0.3%Vulnerability CWE-1242	CVE Database V5	2026-03-09
Medium	6.5	EPSS 0.4%	CVE-2025-41754MBS UBR-01 Mk II · Inclusion of Undocumented Features or Chicken Bits Medium6.5EPSS 0.4%2026-03-09CVE Database V5CVE-2025-41754 A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system. EPSS 0.4%Vulnerability CWE-1242	CVE Database V5	2026-03-09
Critical	10.0	EPSS 0.3%	CVE-2025-12176Azure Access Technology BLU-IC2 · Inclusion of Undocumented Features or Chicken Bits Critical10.0EPSS 0.3%2025-10-24CVE Database V5CVE-2025-12176 Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.3%Vulnerability CWE-1242	CVE Database V5	2025-10-24
Critical	9.8	EPSS 0.3%	CVE-2025-55050Baicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 · CWE-1242 Critical9.8EPSS 0.3%2025-09-09CVE Database V5CVE-2025-55050 CWE-1242: Inclusion of Undocumented Features EPSS 0.3%Vulnerability CWE-1242	CVE Database V5	2025-09-09
Medium	6.9	EPSS 0.4%	CVE-2025-52548Copeland LP E3 Supervisory Control · CWE-1242 Medium6.9EPSS 0.4%2025-09-02CVE Database V5CVE-2025-52548 E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS. EPSS 0.4%Vulnerability CWE-1242	CVE Database V5	2025-09-02
Medium	6.5	EPSS 0.3%	CVE-2024-7011Sharp Display Solutions NP-CB4500UL · Inclusion of Undocumented Features or Chicken Bits Medium6.5EPSS 0.3%2024-09-27CVE Database V5CVE-2024-7011 Sharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525WLG, NP-P525WLJL, NP-CG6500UL, NP-CG6500WL, NP-CG6700UL, NP-P605UL, NP-P605UL+, NP-P605ULG, NP-P605ULJL, NP-CA4120X, NP-CA4160W, NP-CA4160X, NP-CA4200U, NP-CA4200W, NP-CA4202W, NP-CA4260X, NP-CA4300X, NP-CA4355X, NP-CD2100U, NP-CD2120X, NP-CD2300X, NP-CR2100X, NP-CR2170W, NP-CR2170X, NP-CR2200U, NP-CR2200W, NP-CR2280X, NP-CR2310X, NP-CR2350X, NP-MC302XG, NP-MC332WG, NP-MC332WJL, NP-MC342XG, NP-MC372X, NP-MC372XG, NP-MC382W, NP-MC382WG, NP-MC422XG, NP-ME342UG, NP-ME372W, NP-ME372WG, NP-ME372WJL, NP-ME382U, NP-ME382UG, NP-ME382UJL, NP-ME402X, NP-ME402XG, NP-ME402XJL, NP-CB4500XL, NP-CG6400UL, NP-CG6400WL, NP-CG6500XL, NP-PE455UL, NP-PE455ULG, NP-PE455WL, NP-PE455WLG, NP-PE505XLG, NP-CB4600U, NP-CF6600U, NP-P474U, NP-P554U, NP-P554U+, NP-P554UG, NP-P554UJL, NP-CG6600UL, NP-P547UL, NP-P547ULG, NP-P547ULJL, NP-P607UL+, NP-P627UL, NP-P627UL+, NP-P627ULG, NP-P627ULJL, NP-PV710UL-B, NP-PV710UL-B1, NP-PV710UL-W, NP-PV710UL-W+, NP-PV710UL-W1, NP-PV730UL-BJL, NP-PV730UL-WJL, NP-PV800UL-B, NP-PV800UL-B+, NP-PV800UL-B1, NP-PV800UL-BJL, NP-PV800UL-W, NP-PV800UL-W+, NP-PV800UL-W1, NP-PV800UL-WJL, NP-CA4200X, NP-CA4265X, NP-CA4300U, NP-CA4300W, NP-CA4305X, NP-CA4400X, NP-CD2125X, NP-CD2200W, NP-CD2300U, NP-CD2310X, NP-CR2105X, NP-CR2200X, NP-CR2205W, NP-CR2300U, NP-CR2300W, NP-CR2315X, NP-CR2400X, NP-MC333XG, NP-MC363XG, NP-MC393WJL, NP-MC423W, NP-MC423WG, NP-MC453X, NP-MC453X, NP-MC453XG, NP-MC453XJL, NP-ME383WG, NP-ME403U, NP-ME403UG, NP-ME403UJL, NP-ME423W, NP-ME423WG, NP-ME423WJL, NP-ME453X, NP-ME453XG, NP-CB4400USL, NP-CB4400WSL, NP-CB4510UL, NP-CB4510WL, NP-CB4510XL, NP-CB4550USL, NP-CB6700UL, NP-CG6510UL, NP-PE456USL, NP-PE456USLG, NP-PE456USLJL, NP-PE456WSLG, NP-PE506UL, NP-PE506ULG, NP-PE506ULJL, NP-PE506WL, NP-PE506WLG, NP-PE506WLJL) allows an attacker to cause a denial-of-service (DoS) condition via SNMP service. EPSS 0.3%Vulnerability CWE-1242	CVE Database V5	2024-09-27

Page 1 of 1