Static engineering credentials exposed in a mobile application
Qardio · Wearable health
- Dominant path
- Account authority
- Published baseline
- CVSS v3.1 6.6 MEDIUM
Vulnerability registry
Consequence-scored vulnerabilities in cyber-physical systems and AI devices. Search by device, vendor, CVE, or path.
40 matching records
| ID | Vulnerability | Device | System class | Path | Score | CVSS |
|---|---|---|---|---|---|---|
| CPATH-2026-0001 | Static engineering credentials exposed in a mobile application | Blood-pressure monitor and companion applicationQardioARM A100, Heart Health iOS 2.7.4 Qardio | Wearable health | Account authority | CRITICAL | CVSS v3.1 6.6 MEDIUM |
| CPATH-2026-0002 | Insufficient audit logging | Portable ventilator systemLife2000 Ventilation System 06.08.00.00 and earlier, Life2000 Service PC Baxter | Medical IoT | Observability and recovery | MONITOR | CVSS v3.1 10 CRITICAL |
| CPATH-2026-0003 | Unsigned firmware loading and hard-coded network beacon | Patient monitorContec CMS8000 Contec | Medical IoT | Firmware trust root · Device-control safety · Data privacy | CRITICAL | CVSS v4.0 8.2 HIGH |
| CPATH-2026-0004 | Unprotected JTAG flash read/write access | Portable ventilatorLife2000 Ventilation System 06.08.00.00 and earlier Baxter | Medical IoT | Device-control safety · Firmware trust root | CRITICAL | CVSS v3.1 9.3 CRITICAL |
| CPATH-2026-0005 | Hard-coded clinician credentials | Portable ventilatorLife2000 Ventilation System 06.08.00.00 and earlier Baxter | Medical IoT | Account authority | CRITICAL | CVSS v3.1 9.3 CRITICAL |
| CPATH-2026-0006 | UDP out-of-bounds write | Patient monitorContec CMS8000 Contec | Medical IoT | Device-control safety · Device availability and recovery | EMERGENCY | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0007 | Unauthenticated BLE measurement-flood denial of service | Blood-pressure monitor and companion applicationsQardioARM A100, Heart Health iOS 2.7.4, Heart Health Android 2.5.1 Qardio | Wearable health | Device availability and recovery | ELEVATED | CVSS v3.1 7.1 HIGH |
| CPATH-2026-0008 | Extractable firmware files | Mobile health applicationsHeart Health iOS 2.7.4, Heart Health Android 2.5.1 Qardio | Wearable health | Data privacy | HIGH | CVSS v4.0 6.9 MEDIUM |
| CPATH-2026-0009 | Unsigned firmware update | Pneumatic-tube station control panelSwisslog Translogic Nexus Control Panel Swisslog | General IoT | Firmware trust root · Fleet control plane | EMERGENCY | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0010 | TLP20 tcpTxThread stack overflow | Pneumatic-tube station control panelSwisslog Translogic Nexus Control Panel Swisslog | General IoT | Device-control safety · Device availability and recovery | CRITICAL | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0011 | One-click remote code execution via malicious deep link | VR sideloading desktop applicationSideQuest before 0.10.35 Meta | Smart glasses / AR | Perception-to-action · Account authority | CRITICAL | CVSS v3.1 8.8 HIGH |
| CPATH-2026-0012 | Inception-attack immersive VR hijacking | VR headsetMeta Quest, Meta Quest 2, Meta Quest Pro Meta | Smart glasses / AR | Perception-to-action · Perception privacy | CRITICAL | No published baseline |
| CPATH-2026-0013 | GAZEploit remote keystroke inference | Mixed-reality headset and avatar systemApple Vision Pro, visionOS before 1.3, Persona Apple | Smart glasses / AR | Perception privacy · Account authority | CRITICAL | CVSS v3.1 5.3 MEDIUM |
| CPATH-2026-0014 | Broadcom Wi-Fi over-the-air code execution and denial of service | Mixed-reality headset Wi-Fi stackMicrosoft HoloLens Microsoft | Smart glasses / AR | Device-control safety | CRITICAL | CVSS v3.1 8.8 HIGH |
| CPATH-2026-0015 | Unauthenticated pairing-API denial of service | Mixed-reality headsetMicrosoft HoloLens 1, Microsoft HoloLens 2 Microsoft | Smart glasses / AR | Device availability and recovery | CRITICAL | CVSS v3.1 6.5 MEDIUM |
| CPATH-2026-0016 | Face-Mic motion-sensor speech eavesdropping | AR/VR headsetOculus Quest, HTC Vive Pro, Google Cardboard with Nexus 6, Google Cardboard with Samsung Galaxy S6 Meta | Smart glasses / AR | Perception privacy | CRITICAL | No published baseline |
| CPATH-2026-0017 | Unauthenticated MAVLink remote shell | Drone autopilotPX4 Autopilot v1.16.0 SITL PX4 / Dronecode | Drone / autonomous systems | Device-control safety | EMERGENCY | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0018 | VCSEC TPMS integer-overflow remote code execution | Vehicle security controllerTesla Model 3 firmware 2024.8 Tesla | Drone / autonomous systems | Perception-to-action | CRITICAL | CVSS v3.0 7.5 HIGH |
| CPATH-2026-0019 | Gateway firmware signature-validation bypass | Vehicle gateway ECUTesla Model 3 firmware 2023.6 Tesla | Drone / autonomous systems | Device-control safety · Firmware trust root | CRITICAL | CVSS v3.0 9 CRITICAL |
| CPATH-2026-0020 | QuickTransfer Wi-Fi credential derivation | DJI dronesMavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro DJI | Drone / autonomous systems | Perception privacy | CRITICAL | CVSS v3.1 6.6 MEDIUM |
| CPATH-2026-0021 | Projected phantom-object attacks against driver assistance | Driver-assistance systemTesla Model X Autopilot HW 2.5, Tesla Model X Autopilot HW 3, Mobileye 630 Tesla | Drone / autonomous systems | Device-control safety · Perception-to-action | CRITICAL | No published baseline |
| CPATH-2026-0022 | Adaptive GNSS spoofing for drone hijacking | Consumer droneDJI Phantom 3 Standard, DJI Phantom 4, Parrot Bebop 2, 3DR Solo GNSS multi-vendor | Drone / autonomous systems | Perception-to-action · Device-control safety | CRITICAL | No published baseline |
| CPATH-2026-0023 | BLE Wi-Fi configuration root takeover | Unitree quadruped and humanoid robotsGo2, B2, G1, H1 Unitree | Robotics / humanoid | Fleet control plane | EMERGENCY | CVSS v3.1 8.2 HIGH |
| CPATH-2026-0024 | Unauthenticated DDS remote code execution | Quadruped robotUnitree Go2 firmware 1.1.7 through 1.1.11 Unitree | Robotics / humanoid | Device-control safety · Perception privacy | CRITICAL | CVSS v4.0 8.5 HIGH |
| CPATH-2026-0025 | Mobile-app database tampering to root code execution | Quadruped robot and companion applicationUnitree Go2 firmware 1.1.7 through 1.1.11, Unitree Go2 Android application Unitree | Robotics / humanoid | Perception privacy | CRITICAL | CVSS v3.1 9.6 CRITICAL |
| CPATH-2026-0026 | Undocumented CloudSail remote-access backdoor | Quadruped robotUnitree Go1 firmware 2022_05_11_e0d0e617 Unitree | Robotics / humanoid | Device-control safety · Fleet control plane | EMERGENCY | CVSS v3.1 6.6 MEDIUM |
| CPATH-2026-0027 | Dashboard Server OS command injection | Industrial robot controller softwareUniversal Robots PolyScope 5 before 5.25.1 Universal Robots | Robotics / humanoid | Device-control safety · Fleet control plane · Account authority | EMERGENCY | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0028 | Teleoperation command hijacking and emergency-stop abuse | Teleoperated surgical-robot research platformRaven II University of Washington / Raven II | Robotics / humanoid | Perception-to-action · Device-control safety · Device availability and recovery | CRITICAL | No published baseline |
| CPATH-2026-0029 | Unauthenticated command injection | Surveillance camera and recorderHikvision IPC E0/E1/E2/E4/E6/E7/G0/G3/G5/H1/H3/H5/H8/R2/R7 families, Hikvision IPD E7/G3/H3/H5/H7/H8/R7 families, Selected Hikvision NVR models Hikvision | General IoT | Perception-to-action · Account authority · Fleet control plane | EMERGENCY | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0030 | Authentication bypass | Video-surveillance and intercom devicesDahua IPC-HX3XXX, IPC-HX5XXX, and IPC-HUM7XXX, Dahua VTO75X95X, VTO65XXX, and VTH542XH, Dahua NVR1XXX, NVR2XXX, NVR5XXX, and NVR6XX, Dahua XVR4XXX, XVR5XXX, and XVR7XXX, Selected Dahua PTZ and thermal-camera series Dahua | General IoT | Device-control safety · Account authority | EMERGENCY | CVSS v3.1 9.8 CRITICAL |
| CPATH-2026-0031 | Unauthenticated web-management command injection | Wi-Fi routerTP-Link Archer AX21 (AX1800) before 1.1.4 Build 20230219 TP-Link | General IoT | Account authority · Fleet control plane | EMERGENCY | CVSS v3.1 8.8 HIGH |
| CPATH-2026-0032 | Frontend authorization-logic disclosure | Industrial Ethernet switchEDS-508A, PT-508, PT-510, PT-7528, PT-7728, PT-7828, PT-G503, PT-G510, PT-G7728, PT-G7828 Moxa | General IoT | Account authority · Device availability and recovery · Data privacy | HIGH | CVSS v4.0 9.2 CRITICAL |
| CPATH-2026-0033 | Hard-coded smart-lock application credentials | Smart-lock access applicationChirp Access 1.26.0 and earlier Chirp Systems | General IoT | Account authority · Device-control safety | HIGH | CVSS v3.1 4.3 MEDIUM |
| CPATH-2026-0034 | Hard-coded-key Wi-Fi password disclosure | Smart lock and Wi-Fi bridgeAugust Smart Lock Pro, August Connect Wi-Fi Bridge App 10.11.0, Connect firmware 2.2.12 August | General IoT | Data privacy | HIGH | CVSS v3.1 6.5 MEDIUM |
| CPATH-2026-0035 | Unauthenticated, unencrypted RF telemetry | Implantable cardiac devices and telemetry accessoriesConexus RF telemetry protocol, CareLink 2090 Programmer, CareLink and MyCareLink monitors, Amplia, Claria, Compia, Concerto, Consulta, Viva, and Brava CRT-D families, Evera, Maximo II, Mirro, Nayamed, Primo, Protecta, Secura, Virtuoso, and Visia AF ICD families Medtronic | Medical IoT | Device-control safety · Data privacy | CRITICAL | CVSS v3.1 9.3 CRITICAL |
| CPATH-2026-0036 | Unauthenticated RF insulin-delivery control | Insulin pumpMiniMed 508, Paradigm 511, Paradigm 512/712, Paradigm 712E, Paradigm 515/715, Paradigm 522/722, Paradigm 522K/722K, Paradigm 523/723, Paradigm 523K/723K, Paradigm Veo 554/754, Paradigm Veo 554CM/754CM Medtronic | Medical IoT | Device-control safety · Data privacy | CRITICAL | CVSS v3.0 8.8 HIGH |
| CPATH-2026-0037 | RF pairing communication manipulation | Insulin pumpMiniMed 620G, MiniMed 630G, MiniMed 640G, MiniMed 670G Pump communication accessoryGuardian Link 3, Guardian 2 Link, CareLink USB, Contour Next Link 2.4, Contour Plus Link 2.4 Medtronic | Medical IoT | Device-control safety | CRITICAL | CVSS v3.1 4.8 MEDIUM |
| CPATH-2026-0038 | Shared SSH private-key exposure | Patient-monitoring systemCARESCAPE Telemetry Server, ApexPro Telemetry Server, CARESCAPE Central Station, Clinical Information Center, CARESCAPE B450, B650, and B850 monitors GE HealthCare | Medical IoT | Perception-to-action · Device-control safety | EMERGENCY | CVSS v3.1 10 CRITICAL |
| CPATH-2026-0039 | Cleartext Wi-Fi credentials and patient data | Infusion pump and wireless battery moduleSIGMA Spectrum Infusion Pump 8.00.01, Spectrum Wireless Battery Module firmware 16 through 22D28 Baxter | Medical IoT | Account authority · Data privacy | HIGH | CVSS v3.1 4.2 MEDIUM |
| CPATH-2026-0040 | Unsigned critical data enables remote dose alteration | Infusion-pump systemInfusomat Space Large Volume Pump, SpaceStation with SpaceCom2 before 012U000062, Battery Pack SP with Wi-Fi B. Braun | Medical IoT | Device-control safety · Data privacy | CRITICAL | CVSS v3.1 10 CRITICAL |
Insufficient audit logging
Baxter · Medical IoT
- Dominant path
- Observability and recovery
- Published baseline
- CVSS v3.1 10 CRITICAL
Unsigned firmware loading and hard-coded network beacon
Contec · Medical IoT
- Dominant path
- Firmware trust root · Device-control safety · Data privacy
- Published baseline
- CVSS v4.0 8.2 HIGH
Unprotected JTAG flash read/write access
Baxter · Medical IoT
- Dominant path
- Device-control safety · Firmware trust root
- Published baseline
- CVSS v3.1 9.3 CRITICAL
Hard-coded clinician credentials
Baxter · Medical IoT
- Dominant path
- Account authority
- Published baseline
- CVSS v3.1 9.3 CRITICAL
UDP out-of-bounds write
Contec · Medical IoT
- Dominant path
- Device-control safety · Device availability and recovery
- Published baseline
- CVSS v3.1 9.8 CRITICAL
Unauthenticated BLE measurement-flood denial of service
Qardio · Wearable health
- Dominant path
- Device availability and recovery
- Published baseline
- CVSS v3.1 7.1 HIGH
Extractable firmware files
Qardio · Wearable health
- Dominant path
- Data privacy
- Published baseline
- CVSS v4.0 6.9 MEDIUM
Unsigned firmware update
Swisslog · General IoT
- Dominant path
- Firmware trust root · Fleet control plane
- Published baseline
- CVSS v3.1 9.8 CRITICAL
TLP20 tcpTxThread stack overflow
Swisslog · General IoT
- Dominant path
- Device-control safety · Device availability and recovery
- Published baseline
- CVSS v3.1 9.8 CRITICAL
One-click remote code execution via malicious deep link
Meta · Smart glasses / AR
- Dominant path
- Perception-to-action · Account authority
- Published baseline
- CVSS v3.1 8.8 HIGH
Inception-attack immersive VR hijacking
Meta · Smart glasses / AR
- Dominant path
- Perception-to-action · Perception privacy
- Published baseline
- No published baseline
GAZEploit remote keystroke inference
Apple · Smart glasses / AR
- Dominant path
- Perception privacy · Account authority
- Published baseline
- CVSS v3.1 5.3 MEDIUM
Broadcom Wi-Fi over-the-air code execution and denial of service
Microsoft · Smart glasses / AR
- Dominant path
- Device-control safety
- Published baseline
- CVSS v3.1 8.8 HIGH
Unauthenticated pairing-API denial of service
Microsoft · Smart glasses / AR
- Dominant path
- Device availability and recovery
- Published baseline
- CVSS v3.1 6.5 MEDIUM
Face-Mic motion-sensor speech eavesdropping
Meta · Smart glasses / AR
- Dominant path
- Perception privacy
- Published baseline
- No published baseline
Unauthenticated MAVLink remote shell
PX4 / Dronecode · Drone / autonomous systems
- Dominant path
- Device-control safety
- Published baseline
- CVSS v3.1 9.8 CRITICAL
VCSEC TPMS integer-overflow remote code execution
Tesla · Drone / autonomous systems
- Dominant path
- Perception-to-action
- Published baseline
- CVSS v3.0 7.5 HIGH
Gateway firmware signature-validation bypass
Tesla · Drone / autonomous systems
- Dominant path
- Device-control safety · Firmware trust root
- Published baseline
- CVSS v3.0 9 CRITICAL
QuickTransfer Wi-Fi credential derivation
DJI · Drone / autonomous systems
- Dominant path
- Perception privacy
- Published baseline
- CVSS v3.1 6.6 MEDIUM
Projected phantom-object attacks against driver assistance
Tesla · Drone / autonomous systems
- Dominant path
- Device-control safety · Perception-to-action
- Published baseline
- No published baseline
Adaptive GNSS spoofing for drone hijacking
GNSS multi-vendor · Drone / autonomous systems
- Dominant path
- Perception-to-action · Device-control safety
- Published baseline
- No published baseline
BLE Wi-Fi configuration root takeover
Unitree · Robotics / humanoid
- Dominant path
- Fleet control plane
- Published baseline
- CVSS v3.1 8.2 HIGH
Unauthenticated DDS remote code execution
Unitree · Robotics / humanoid
- Dominant path
- Device-control safety · Perception privacy
- Published baseline
- CVSS v4.0 8.5 HIGH
Mobile-app database tampering to root code execution
Unitree · Robotics / humanoid
- Dominant path
- Perception privacy
- Published baseline
- CVSS v3.1 9.6 CRITICAL
Undocumented CloudSail remote-access backdoor
Unitree · Robotics / humanoid
- Dominant path
- Device-control safety · Fleet control plane
- Published baseline
- CVSS v3.1 6.6 MEDIUM
Dashboard Server OS command injection
Universal Robots · Robotics / humanoid
- Dominant path
- Device-control safety · Fleet control plane · Account authority
- Published baseline
- CVSS v3.1 9.8 CRITICAL
Teleoperation command hijacking and emergency-stop abuse
University of Washington / Raven II · Robotics / humanoid
- Dominant path
- Perception-to-action · Device-control safety · Device availability and recovery
- Published baseline
- No published baseline
Unauthenticated command injection
Hikvision · General IoT
- Dominant path
- Perception-to-action · Account authority · Fleet control plane
- Published baseline
- CVSS v3.1 9.8 CRITICAL
Authentication bypass
Dahua · General IoT
- Dominant path
- Device-control safety · Account authority
- Published baseline
- CVSS v3.1 9.8 CRITICAL
Unauthenticated web-management command injection
TP-Link · General IoT
- Dominant path
- Account authority · Fleet control plane
- Published baseline
- CVSS v3.1 8.8 HIGH
Frontend authorization-logic disclosure
Moxa · General IoT
- Dominant path
- Account authority · Device availability and recovery · Data privacy
- Published baseline
- CVSS v4.0 9.2 CRITICAL
Hard-coded smart-lock application credentials
Chirp Systems · General IoT
- Dominant path
- Account authority · Device-control safety
- Published baseline
- CVSS v3.1 4.3 MEDIUM
Hard-coded-key Wi-Fi password disclosure
August · General IoT
- Dominant path
- Data privacy
- Published baseline
- CVSS v3.1 6.5 MEDIUM
Unauthenticated, unencrypted RF telemetry
Medtronic · Medical IoT
- Dominant path
- Device-control safety · Data privacy
- Published baseline
- CVSS v3.1 9.3 CRITICAL
Unauthenticated RF insulin-delivery control
Medtronic · Medical IoT
- Dominant path
- Device-control safety · Data privacy
- Published baseline
- CVSS v3.0 8.8 HIGH
RF pairing communication manipulation
Medtronic · Medical IoT
- Dominant path
- Device-control safety
- Published baseline
- CVSS v3.1 4.8 MEDIUM
Shared SSH private-key exposure
GE HealthCare · Medical IoT
- Dominant path
- Perception-to-action · Device-control safety
- Published baseline
- CVSS v3.1 10 CRITICAL
Cleartext Wi-Fi credentials and patient data
Baxter · Medical IoT
- Dominant path
- Account authority · Data privacy
- Published baseline
- CVSS v3.1 4.2 MEDIUM
Unsigned critical data enables remote dose alteration
B. Braun · Medical IoT
- Dominant path
- Device-control safety · Data privacy
- Published baseline
- CVSS v3.1 10 CRITICAL
No matching records.
Try a broader search.