I O DATA Device, INC. vulnerabilities
33 vulnerabilities
Known vulnerabilities in I O DATA Device, INC. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 31 products.
Products
31- TS Ptcam/Poe4 vulnerabilities
- TS WLC24 vulnerabilities
- TS WLCE4 vulnerabilities
- TS Wptcam4 vulnerabilities
- TS Wptcam24 vulnerabilities
- TS WRLC4 vulnerabilities
- UD LT24 vulnerabilities
- Multiple I O DATA Network Camera Products3 vulnerabilities
- TS WRLA3 vulnerabilities
- TS WRLP3 vulnerabilities
- UD LT13 vulnerabilities
- UD Lt1/Ex3 vulnerabilities
- WN Ax1167Gr3 vulnerabilities
- WN G300R33 vulnerabilities
- HDL T1NV2 vulnerabilities
- HDL T1WH2 vulnerabilities
- HDL T2NV2 vulnerabilities
- HDL T2WH2 vulnerabilities
- HDL T3NV2 vulnerabilities
- HDL T3WH2 vulnerabilities
- HDL TC12 vulnerabilities
- HDL Tc5002 vulnerabilities
- WFS SR012 vulnerabilities
- WN 7D36Qr2 vulnerabilities
- WN 7D36Qr/Ue2 vulnerabilities
- Clone For Windows1 vulnerabilities
- IP Address Setting Tool "Magicalfinder"1 vulnerabilities
- LAN DISK Connect1 vulnerabilities
- Narsus App1 vulnerabilities
- TS Ptcam1 vulnerabilities
- WN Ac1167Gr1 vulnerabilities
CVE-2018-0512i-o data device, inc.ip address setting tool "magicalfinder"+45
EPSS score0.66%
Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors.CVE-2018-0662i-o data device, inc.multiple i-o data network camera products+3EPSS score0.42%
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code.CVE-2018-0661i-o data device, inc.multiple i-o data network camera products+3EPSS score0.64%
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to bypass access restriction to add files on a specific directory that may result in executing arbitrary OS commands/code or information including credentials leakage or alteration.CVE-2018-0663i-o data device, inc.multiple i-o data network camera products+3EPSS score1.62%
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands on the device via unspecified vector.CVE-2016-7820i-o data device, inc.ts-wrla+3EPSS score3.25%
Buffer overflow in I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to cause a denial-of-service (DoS) or execute arbitrary code via unspecified vectors.CVE-2016-7819i-o data device, inc.ts-wrla+3EPSS score2.20%
I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.CVE-2016-7814i-o data device, inc.ts-wrla+3EPSS score2.66%
I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obtain authentication credentials via unspecified vectors.CVE-2016-7807i-o data device, inc.wfs-sr01+1EPSS score2.02%
I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors.CVE-2016-7806i-o data device, inc.wfs-sr01+1EPSS score3.98%
I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2025-61865i-o data device, inc.clone for windows+1EPSS score0.20%
Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.CVE-2025-55075i-o data device, inc.wn-7d36qr+1EPSS score0.33%
Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker.CVE-2025-26856i-o data device, inc.ud-lt2EPSS score1.12%
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.CVE-2025-20617i-o data device, inc.ud-lt2EPSS score1.14%
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-26856.CVE-2025-58116i-o data device, inc.wn-7d36qr+1EPSS score1.12%
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.CVE-2025-22450i-o data device, inc.ud-lt2EPSS score0.38%
Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports.CVE-2025-32738i-o data device, inc.hdl-t1nv+7EPSS score0.42%
Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings.CVE-2025-32002i-o data device, inc.hdl-t1nv+7EPSS score1.58%
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitrary OS command.CVE-2025-23237i-o data device, inc.ud-lt2EPSS score0.90%
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If a user logs in to CLI of the affected product, an arbitrary OS command may be executed.CVE-2017-2148i-o data device, inc.wn-ac1167gr+1EPSS score0.89%
Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2017-2142i-o data device, inc.wn-g300r3+1EPSS score3.08%
Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.