The version of VxWorks installed on the remote host is 6.x, prior to 6.9.4, and is affected by multiple vulnerabilities :

 - A specially crafted TCP-segment with the URG-flag set may cause overflow of the buffer passed to recv(), recvfrom() or recvmsg() socket routines. (CVE-2019-12255)
 - A specially crafted IPv4 packet, containing invalid encoded SSRR/LSRR options, may cause call-stack overflow. No specific services beyond IPv4 protocol support is required. (CVE-2019-12257)

The version of VxWorks installed on the remote host is 6.9.x, prior to 6.9.4.12, or 7 (SR540), or 7 (SR540), and is affected by multiple vulnerabilities :

 - A specially crafted IPv4 packet, containing invalid encoded SSRR/LSRR options, may cause call-stack overflow. No specific services beyond IPv4 protocol support is required. (CVE-2019-12256)
 - A specially crafted packet containing illegal TCP-options can result in the victim not just dropping the TCP-segment but also drop the TCP-session. (CVE-2019-12258)
 - This vulnerability require that the TCP/IP-stack is assigned a multicast address the API intended for assigning unicast addresses or something with the same logical flaw is a prerequisite. (CVE-2019-12259)
 - A series of specially crafted TCP-segments where the last step is a TCP-segment with the URG-flag set may cause overflow of the buffer passed to recv(), recvfrom() or 'recvmsg()' socket routines. (CVE-2019-12260)
 - A specially crafted response to the connection attempt, where also the FIN- and URG-flags are set is sent as a response. This may put the victim into an inconsistent state, which make it possible to send yet another segment that trigger a buffer overflow. (CVE-2019-12261)
 - The RARP reception handler verifies that the packet is well formed, but fails to verify that the node has an ongoing RARP-transaction matching the received packet. (CVE-2019-12262)
 - A series of segments with and without the URG-flag set must arrive with a very specific timing while an application on the victim is receiving from the session. The victim must be using a SMP-kernel and two or more CPU-cores alternatively an uni-processor kernel where the receiving task and the network task executes at different priorities. (CVE-2019-12263)
 - The VxWorks DHCP client fails to properly validate that the offered IP-address in a DHCP renewal or offer response contains a valid unicast address. An attacker may assign multicast or broadcast addresses to the victim. (CVE-2019-12264)
 - An attacker can create specially crafted and fragmented IGMPv3 query report, which may result in the victim transmitting undefined buffer content. (CVE-2019-12265)

The remote host is running a Grandstream GXV3370 device, firmware version prior to 1.0.1.41 , and is therefore affected by a RCE attack vector that allows remote authenticated users to execute arbitrary code via shell metacharacters in a '/manager?action=getlogcat' priority field.

The remote host is running a Grandstream GXV3275 device, firmware version prior to 1.0.3.219, and is therefore affected by a remote command execution vulnerability that exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.

The remote host is running a Grandstream GXV3240 device, firmware version prior to 1.0.3.219, and is therefore affected by a remote command execution vulnerability that exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.

The remote host is running a Grandstream IP Multimedia Phone over the Session Initiation Protocol (SIP).

The remote host is running a Grandstream UCM6204 IP PBX, firmware version prior to 1.0.19.20, and is therefore affected by a RCE attack vector. An attacker can exploit a blind command injection vulnerability in the "file-backup" parameter of the 'backupUCMConfig' API call allowing the execution of arbitrary code. (CVE-2019-10662) A vulnerability allows remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the '/cgi?' URI. (CVE-2019-10663)

The remote host is running a Grandstream IP PBX Appliance over the Session Initiation Protocol (SIP).

The remote host is running a Grandstream audio/video device over the Session Initiation Protocol (SIP), which is a communication protocol for video and voice calls over the Internet.

The remote host is an S2 Network Node. S2 Network Node is an intelligent field panel that handles distributed processing for S2 NetBox access control and event monitoring systems. Access control and events from connected devices are aggregated to the S2 NetBox web interface and S2 Network Node supports up to seven modular S2 application blades for access control, inputs, outputs and temperature probes.

The remote host is an S2 Network Controller. S2 Network Controller is an intelligent field panel that handles distributed processing for S2 NetBox access control and event monitoring systems. Access control and events from connected devices are aggregated to the S2 NetBox web interface and S2 Network Controller supports up to seven modular S2 application blades for access control, inputs, outputs and temperature probes.

The remote host has been observed communicating via the HL7 protocol. HL7 provides a framework for the exchange, integration, sharing, and retrieval of electronic health information.

The remote host has been observed communicating via the DICOM protocol. The DICOM, or Digital Imaging and Communications in Medicine, is used to transfer medical images and related information. DICOM is utilized by many radiology, cardiology imaging, and radiotherapy devices.

The remote host has been identified as a Withings Wi-Fi Body Scale

The remote host has been identified as a Belkin WeMo Switch Smart Plug

The remote host has been identified as a Belkin WeMo Link

The remote host has been identified as a Belkin WeMo Insight Switch

The remote host has been identified as a Lightify Wireless Bridge

The remote host has been identified as an Ednet Gateway

The remote host has been identified as a Ednet Smart Camera

The remote host has been identified as a Edimax Smart Plug

The remote host has been identified as a Edimax Network Camera

The remote host has been identified as a D-Link Wi-Fi Water Sensor

The remote host has been identified as a D-Link Smart Plug 

The remote host has been identified as a D-Link Smart Siren 

The remote host has been identified as a D-Link Smart Door Sensor

The remote host has been identified as a D-Link Home Hub

The remote host has been identified as a D-Link Wi-Fi Day Camera

The remote host has been identified as a D-Link Wi-Fi Camera

The remote host has been identified as a Xenon Smart Plug

The device has advertised itself as a LIFX Light Bulb on the network.

The the remote client is running the Tuyaus Smart Application

The the remote client running the Tuyaus Smart Application has started a new session

The the remote client running the Tuyaus Smart Application has an active session

ID	Name	Severity
701084	VxWorks 6.x < 6.9.4 Multiple Vulnerabilities (URGENT/11)	critical
701083	VxWorks 6.9.x < 6.9.4.12 / 7 (SR540) / 7 (SR610) Multiple Vulnerabilities (URGENT/11)	critical
700498	Grandstream GXV3370 < 1.0.1.41 RCE	high
700497	Grandstream GXV3275 < 1.0.3.219 RCE	critical
700496	Grandstream GXV3240 < 1.0.3.219 RCE	critical
700495	Grandstream IP Multimedia Phone Version GXV3370 Firmware Detection (SIP)	info
700494	Grandstream IP Multimedia Phone Version GXV3275 Firmware Detection (SIP)	info
700493	Grandstream IP Multimedia Phone Version GXV3240 Firmware Detection (SIP)	info
700492	Grandstream IP PBX Appliance UCM6204 < 1.0.19.20 RCE	high
700485	Grandstream IP PBX Appliance Version Detection (SIP)	info
700484	Grandstream AV Device Detection (SIP)	info
700478	S2 Network Node Multicast Detection	info
700477	S2 Network Controller Detection	info
700476	S2 Network Node Detection (deprecated)	info
700406	HL7 Protocol Detection	info
700405	HL7 Protocol Server Detection	info
700404	HL7 Protocol Detection	info
700403	HL7 Protocol Server Detection	info
700402	DICOM Protocol Server Detection	info
700401	DICOM Protocol Client Detection	info
700400	DICOM Protocol Detection	info
700296	Withings Wi-Fi Body Scale Detection via HTTP	info
700294	Belkin WeMo Switch Smart Plug Detection via SSDP	info
700293	Belkin WeMo Link Detection via SSDP	info
700292	Belkin WeMo Insight Switch Detection via SSDP	info
700289	Lightify Wireless Bridge Detection via mDNS	info
700288	Ednet Gateway Detection via UDP	info
700287	Ednet Smart Camera Detection via TFTP	info
700286	Edimax Smart Plug Detection via HTTP	info
700285	Edimax Network Camera Detection via mDNS	info
700284	D-Link Wi-Fi Water Sensor Detection via HTTP	info
700283	D-Link Wi-Fi Water Sensor Detection via mDNS	info
700282	D-Link Smart Plug Detection via HTTP	info
700281	D-Link Smart Plug Detection via mDNS	info
700280	D-Link Smart Siren Detection via HTTP	info
700279	D-Link Smart Siren Detection via mDNS	info
700278	D-Link Smart Door Sensor via mDNS	info
700277	D-Link Home Hub Detection via mDNS	info
700276	D-Link Home Hub Detection via HTTP	info
700275	D-Link Wi-Fi Day Camera Detection via UDP	info
700274	D-Link Wi-Fi Day Camera Detection via mDNS	info
700273	D-Link Wi-Fi Camera Detection via mDNS	info
700272	D-Link Wi-Fi Camera Detection via HTTP	info
700270	Xenon Smart Plug Detection via HTTP (deprecated)	info
700269	Geekbes Smart Socket Detection via HTTP	info
700267	LIFX Detection via mDNS	info
700266	TuyaUS Client Detection via HTTP	info
700265	TuyaUS Client Session Initialization Detection via HTTP	info
700264	TuyaUS Server Session Initiation Detection via HTTP (deprecated)	info
700263	TuyaUS Active Session Detection via HTTP (deprecated)	info

IoT Family for Nessus Network Monitor

critical

critical

high

critical

critical

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info