{"resultsPerPage":8,"startIndex":0,"totalResults":8,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-05T02:08:15.977","vulnerabilities":[{"cve":{"id":"CVE-2007-2433","sourceIdentifier":"cve@mitre.org","published":"2007-05-02T10:19:00.000","lastModified":"2026-06-16T22:39:34.440","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in index.php in Ariadne 2.4.1 allows remote attackers to inject arbitrary web script or HTML via the ARLogin parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."},{"lang":"es","value":"Vulnerabilida de secuencia de comandos en sitios cruzados (XSS) en index.php en Ariadne 2.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro ARLogin. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos a partir de la información de terceros. \r\n"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ariadne:ariadne_cms:2.4.1:*:*:*:*:*:*:*","matchCriteriaId":"D7B99A9B-0439-4BF0-AB0B-EA1AA5EB7CDD"}]}]}],"references":[{"url":"http://secunia.com/advisories/25090","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://www.osvdb.org/35493","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/23735","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33987","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/25090","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://www.osvdb.org/35493","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/23735","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33987","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2016-10115","sourceIdentifier":"cve@mitre.org","published":"2017-01-04T08:59:00.147","lastModified":"2026-06-17T00:39:05.070","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8.1_6094 and earlier have a default password of 12345678, which makes it easier for remote attackers to obtain access after a factory reset or in a factory configuration."},{"lang":"es","value":"Estaciones base NETGEAR Arlo con firmware 1.7.5_6178 y versiones anteriores, dispositivos Arlo Q con firmware 1.8.0_5551 y versiones anteriores y dispositivos Arlo Q Plus con firmware 1.8.1_6094 y versiones anteriores tienen una contraseña por defecto de 12345678, lo que facilita a atacantes remotos obtener acceso tras un reseteo de fábrica o en una configuración de fábrica."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:arlo_base_station_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.7.5_6178","matchCriteriaId":"C68276B0-07D4-42C0-8B63-61ACCFA66CCE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmb30x0:-:*:*:*:*:*:*:*","matchCriteriaId":"3CE76F66-9905-4FD5-B13F-17B214CF492D"},{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmk3xx0:-:*:*:*:*:*:*:*","matchCriteriaId":"670513FF-5BD7-493D-8B4B-1F67A0EC49B3"},{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vms3xx0:-:*:*:*:*:*:*:*","matchCriteriaId":"786C64D4-33DE-4B12-89CC-1A52E9304328"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:arlo_q_camera_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.0_5551","matchCriteriaId":"55232F11-1DFE-4896-B3C1-BA20BA2EC2B6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmc3040:-:*:*:*:*:*:*:*","matchCriteriaId":"738FF594-37EF-44C5-AD2A-64A128259AF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:arlo_q_plus_camera_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.1_6094","matchCriteriaId":"F99E0CEE-1472-4237-8F0F-34404A51F592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmc3040s:-:*:*:*:*:*:*:*","matchCriteriaId":"25875C09-1C48-4A95-8211-85C357A19255"}]}]}],"references":[{"url":"http://blog.newskysecurity.com/2016/09/factory_reset_vuln_in_netgear_arlo/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability","source":"cve@mitre.org","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/95265","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://blog.newskysecurity.com/2016/09/factory_reset_vuln_in_netgear_arlo/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/95265","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2016-10116","sourceIdentifier":"cve@mitre.org","published":"2017-01-04T08:59:00.193","lastModified":"2026-06-17T00:39:05.190","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8.1_6094 and earlier use a pattern of adjective, noun, and three-digit number for the customized password, which makes it easier for remote attackers to obtain access via a dictionary attack."},{"lang":"es","value":"Estaciones base NETGEAR Arlo con firmware 1.7.5_6178 y versiones anteriores, dispositivos Arlo Q con firmware 1.8.0_5551 y versiones anteriores y dispositivos Arlo Q Plus con firmware 1.8.1_6094 y versiones anteriores utiliza un patrón de adjetivo, sustantivo y número de tres dígitos para la contraseña personalizada, lo que facilita a atacantes remotos obtener acceso a través de un ataque de diccionario."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-264"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:arlo_base_station_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.7.5_6178","matchCriteriaId":"C68276B0-07D4-42C0-8B63-61ACCFA66CCE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmb30x0:-:*:*:*:*:*:*:*","matchCriteriaId":"3CE76F66-9905-4FD5-B13F-17B214CF492D"},{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmk3xx0:-:*:*:*:*:*:*:*","matchCriteriaId":"670513FF-5BD7-493D-8B4B-1F67A0EC49B3"},{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vms3xx0:-:*:*:*:*:*:*:*","matchCriteriaId":"786C64D4-33DE-4B12-89CC-1A52E9304328"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:arlo_q_camera_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.0_5551","matchCriteriaId":"55232F11-1DFE-4896-B3C1-BA20BA2EC2B6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmc3040:-:*:*:*:*:*:*:*","matchCriteriaId":"738FF594-37EF-44C5-AD2A-64A128259AF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:arlo_q_plus_camera_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.1_6094","matchCriteriaId":"F99E0CEE-1472-4237-8F0F-34404A51F592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:vmc3040s:-:*:*:*:*:*:*:*","matchCriteriaId":"25875C09-1C48-4A95-8211-85C357A19255"}]}]}],"references":[{"url":"http://blog.newskysecurity.com/2016/09/brute-force-vulnerability-netgear-arlo/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability","source":"cve@mitre.org","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/95266","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://blog.newskysecurity.com/2016/09/brute-force-vulnerability-netgear-arlo/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/95266","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2019-3949","sourceIdentifier":"vulnreport@tenable.com","published":"2019-07-09T18:15:11.670","lastModified":"2026-06-17T02:35:56.447","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Arlo Basestation firmware 1.12.0.1_27940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This could allow an attacker to upload or download arbitrary files and possibly execute malicious code on the device."},{"lang":"es","value":"Arlo Basestation firmware versión 1.12.0.1_27940 y anterior, contienen una configuración inapropiada de la red que permite el acceso a las interfaces de red restringidas. Esto podría permitir a un atacante cargar o descargar archivos arbitrarios y posiblemente ejecutar código malicioso en el dispositivo."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"Arlo","product":"Basestation firmware","versions":[{"version":"1.12.0.1_27940 and prior","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-16"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb3010_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.3_2762","matchCriteriaId":"64A7DF98-4FD5-4A09-AEF1-E4D9F7D48B7D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb3010:-:*:*:*:*:*:*:*","matchCriteriaId":"E3750739-BEBE-40A8-8BA5-D3CB79064263"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb4000_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.3_2762","matchCriteriaId":"5D74D819-C51C-4AF0-A644-36F831B75AD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb4000:-:*:*:*:*:*:*:*","matchCriteriaId":"49AB1BD0-56AE-41C6-BCC6-5CFECC0F313C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb3500_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.4_2773","matchCriteriaId":"00403FFE-61F7-4F5A-8389-8C44E1B353C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb3500:-:*:*:*:*:*:*:*","matchCriteriaId":"C8C9EC35-3512-4E82-B3C2-34EE7CC77EB4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb4500_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.4_2773","matchCriteriaId":"4CBA42FC-FC70-41FD-9EFF-8320F59B0BE7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb4500:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB085BD-CDC9-41A1-B82D-A57965BC7C2C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb5000_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.2_2824","matchCriteriaId":"ADC590BD-092E-475C-B64D-68BE7F9E1312"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb5000:-:*:*:*:*:*:*:*","matchCriteriaId":"A648C2AB-F4E1-46B9-9F05-626BC739E508"}]}]}],"references":[{"url":"https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechanisms","source":"vulnreport@tenable.com","tags":["Vendor Advisory"]},{"url":"https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechanisms","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2019-3950","sourceIdentifier":"vulnreport@tenable.com","published":"2019-07-09T18:15:11.747","lastModified":"2026-06-17T02:35:56.550","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to."},{"lang":"es","value":"Arlo Basestation firmware versión 1.12.0.1_27940 y anteriores, contienen una combinación de nombre de usuario y contraseña codificada que permite el acceso de root al dispositivo cuando se conecta una interfaz serial en tarjeta"}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"Arlo","product":"Basestation firmware","versions":[{"version":"1.12.0.1_27940 and prior","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb3010_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.3_2762","matchCriteriaId":"64A7DF98-4FD5-4A09-AEF1-E4D9F7D48B7D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb3010:-:*:*:*:*:*:*:*","matchCriteriaId":"E3750739-BEBE-40A8-8BA5-D3CB79064263"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb4000_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.3_2762","matchCriteriaId":"5D74D819-C51C-4AF0-A644-36F831B75AD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb4000:-:*:*:*:*:*:*:*","matchCriteriaId":"49AB1BD0-56AE-41C6-BCC6-5CFECC0F313C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb3500_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.4_2773","matchCriteriaId":"00403FFE-61F7-4F5A-8389-8C44E1B353C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb3500:-:*:*:*:*:*:*:*","matchCriteriaId":"C8C9EC35-3512-4E82-B3C2-34EE7CC77EB4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb4500_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.4_2773","matchCriteriaId":"4CBA42FC-FC70-41FD-9EFF-8320F59B0BE7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb4500:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB085BD-CDC9-41A1-B82D-A57965BC7C2C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:vmb5000_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.2.2_2824","matchCriteriaId":"ADC590BD-092E-475C-B64D-68BE7F9E1312"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:vmb5000:-:*:*:*:*:*:*:*","matchCriteriaId":"A648C2AB-F4E1-46B9-9F05-626BC739E508"}]}]}],"references":[{"url":"https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechanisms","source":"vulnreport@tenable.com","tags":["Vendor Advisory"]},{"url":"https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechanisms","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-31505","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2021-06-29T15:15:18.993","lastModified":"2026-06-17T03:51:55.467","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The device can be booted into a special operation mode where hard-coded credentials are accepted for SSH authentication. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-12890."},{"lang":"es","value":"Esta vulnerabilidad permite a atacantes con acceso físico escalar privilegios en las instalaciones afectadas de Arlo Q Plus versión 1.9.0.3_278. No es requerida una autenticación para explotar esta vulnerabilidad. El fallo específico se presenta en el servicio SSH. El dispositivo puede ser arrancado en un modo de funcionamiento especial en donde credenciales embebidas son aceptadas para la autenticación SSH. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar código arbitrario en el contexto de root. Fue ZDI-CAN-12890"}],"affected":[{"source":"zdi-disclosures@trendmicro.com","affectedData":[{"vendor":"Arlo","product":"Q Plus","versions":[{"version":"1.9.0.3_278","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:arlo:q_plus_firmware:1.9.0.3_278:*:*:*:*:*:*:*","matchCriteriaId":"0BFBFA34-86DC-4579-8A13-0DE2874E2CA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:arlo:q_plus:-:*:*:*:*:*:*:*","matchCriteriaId":"D65554E0-06B5-4E80-81F5-C42C9AD5A3FA"}]}]}],"references":[{"url":"https://kb.arlo.com/000062592/Security-Advisory-for-Arlo-Q-Plus-SSH-Use-of-Hard-coded-Credentials-Allowing-Privilege-Escalation","source":"zdi-disclosures@trendmicro.com","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-683/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://kb.arlo.com/000062592/Security-Advisory-for-Arlo-Q-Plus-SSH-Use-of-Hard-coded-Credentials-Allowing-Privilege-Escalation","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-683/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2025-39475","sourceIdentifier":"audit@patchstack.com","published":"2025-06-09T16:15:40.230","lastModified":"2026-06-17T09:18:01.087","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3."},{"lang":"es","value":"La vulnerabilidad de Path Traversal en Frenify Arlo permite la inclusión de archivos locales en PHP. Este problema afecta a Arlo desde la versión n/d hasta la 6.0.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Frenify","product":"Arlo","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"arlo","versions":[{"version":"0","lessThanOrEqual":"6.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-06-10T13:39:23.839605Z","id":"CVE-2025-39475","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-35"}]}],"references":[{"url":"https://patchstack.com/database/Wordpress/Theme/arlo/vulnerability/wordpress-arlo-6-0-3-local-file-inclusion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2025-69082","sourceIdentifier":"audit@patchstack.com","published":"2026-01-07T12:17:06.277","lastModified":"2026-10-07T09:10:00.160","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3."},{"lang":"es","value":"Neutralización Incorrecta de Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en Frenify Arlo arlo permite XSS Reflejado. Este problema afecta a Arlo: desde n/d hasta 6.0.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Frenify","product":"Arlo","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"arlo","versions":[{"version":"0","lessThanOrEqual":"6.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-07T14:16:49.608581Z","id":"CVE-2025-69082","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/Wordpress/Theme/arlo/vulnerability/wordpress-arlo-theme-6-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}}]}