CERT Advisory
CISA Warns of Missing Authorization in Meari IoT Cloud Platform
Meari IoT Cloud OpenAPI authorization flaws can expose or alter another owner's device data through authenticated accounts. CISA records no planned fix; confirm provider disposition and assess dependencies before disconnection, without treating local segmentation as cloud remediation.
CISA Warns of Critical Authentication Gaps in Monta Charging Services
Monta charging-service weaknesses require provider-confirmed controls and authenticated station connections using OCPP Security Profile 2. Coordinate migration with station vendors and operations; an app update or TLS without station authentication does not establish remediation.
WEBCON BPS Updates Fix Vacation-Data Authorization Bypass
WEBCON BPS can expose other employees' vacation schedules through an authenticated API authorization flaw. Install the branch-appropriate fix and validate cross-team access with synthetic accounts; a login should not authorize every employee's schedule.
Global IT Weoll Update Fixes SSRF Token Disclosure
Weoll releases before 3.2.45.44 have an SSRF issue identified with JWT disclosure. Apply the supported update and review outbound requests, while retaining the public evidence limit: the exact endpoint and token flow are undocumented.
Abis Technology AVESIS Update Fixes Open Redirect
Affected AVESIS builds can redirect users to untrusted destinations without an attacker account. Confirm the deployed build and supported correction with the service owner; an open redirect alone does not establish account takeover or code execution.
Changing NHIServiSign Update Fixes OS Command Injection
A malicious web page can induce the identified Linux NHIServiSign client to execute operating-system commands when visited. Update affected signing endpoints to the vendor's fixed release; related Windows and macOS branding does not establish applicability.
TR-CERT Warns of Critical SQL Injection in Unsupported KarelIPS
Unsupported KarelIPS has an unauthenticated blind SQL-injection flaw with no fixed release identified. Restrict exposure, preserve relevant evidence and plan retirement or replacement; compensating controls do not repair the defect.