Columbiaweather Weather_microserver
8 CVEs affecting Columbiaweather Weather_microserver. Latest disclosed: 2026-01-07. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61939 | High | 8.8 | 2026-01-07 | An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local net… |
CVE-2018-18877 | High | 8.8 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that al… |
CVE-2018-18879 | High | 8.8 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as use… |
CVE-2025-66620 | High | 8.0 | 2026-01-07 | An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroSer… |
CVE-2018-18878 | High | 7.5 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to sen… |
CVE-2018-18875 | Medium | 5.4 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject… |
CVE-2018-18880 | Medium | 5.4 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allows remote authentica… |
CVE-2018-18876 | Medium | 5.3 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any file present on the… |