I O DATA Device, INC. UD LT2 vulnerabilities

4 vulnerabilities

Known vulnerabilities in I O DATA Device, INC. UD LT2, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.2HighCVE-2025-26856i-o data device, inc. · ud-lt2i-o data device, inc. ud-lt2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.EPSS1.12%7.2HighCVE-2025-20617i-o data device, inc. · ud-lt2i-o data device, inc. ud-lt2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-26856.EPSS1.14%7.5HighCVE-2025-22450i-o data device, inc. · ud-lt2i-o data device, inc. ud-lt2Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports.EPSS0.38%6.6MediumCVE-2025-23237i-o data device, inc. · ud-lt2i-o data device, inc. ud-lt2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If a user logs in to CLI of the affected product, an arbitrary OS command may be executed.EPSS0.90%