Logitech
21 CVEs across 55 Logitech products. Browse Logitech vulnerabilities, severities, and proof-of-concept exploits.
Logitech products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8258 | High | 7.8 | 2024-09-10 | Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute a… |
CVE-2024-8011 | Medium | 5.5 | 2024-08-25 | Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions granted by the user to Op… |
CVE-2024-4031 | Medium | 4.4 | 2024-04-23 | Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code. |
CVE-2024-2537 | Medium | 4.4 | 2024-03-15 | Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion. |
CVE-2022-36263 | High | 7.3 | 2022-08-19 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. |
CVE-2022-0916 | High | 8.4 | 2022-05-03 | An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks duri… |
CVE-2022-0915 | Medium | 6.0 | 2022-04-12 | There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vuln… |
CVE-2021-38547 | Medium | 5.9 | 2021-08-11 | Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-o… |
CVE-2021-20642 | Medium | 6.5 | 2021-02-12 | Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) condition by sending a… |
CVE-2021-20641 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially… |
CVE-2021-20640 | Medium | 6.8 | 2021-02-12 | Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vec… |
CVE-2021-20639 | Medium | 6.8 | 2021-02-12 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20638 | Medium | 6.8 | 2021-02-12 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20637 | Medium | 6.5 | 2021-02-12 | Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) condition by sending… |
CVE-2021-20636 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a speciall… |
CVE-2021-20635 | Medium | 6.5 | 2021-02-12 | Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and ac… |
CVE-2019-13055 | Medium | 6.5 | 2019-06-29 | Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions… |
CVE-2019-13054 | Medium | 6.5 | 2019-06-29 | The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. On Windows, any text may be injected by using… |
CVE-2019-13053 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker must press a "magic" key combination while sniffing cryptographic data… |
CVE-2019-13052 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed. |
CVE-2016-10761 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack. |
CVE-2019-12506 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injecti… |
CVE-2018-15723 | Critical | 9.8 | 2018-12-20 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attac… |
CVE-2018-15722 | High | 8.1 | 2018-12-20 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can in… |
CVE-2018-15721 | Critical | 9.8 | 2018-12-20 | The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use thi… |
CVE-2018-15720 | Critical | 9.8 | 2018-12-20 | Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API. |
CVE-2018-0621 | High | 7.8 | 2018-07-26 | Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL… |
CVE-2018-0620 | High | 7.8 | 2018-07-26 | Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspe… |
CVE-2017-16568 | Medium | 5.4 | 2017-11-10 | Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to… |
CVE-2017-16567 | Medium | 5.4 | 2017-11-10 | Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attacke… |
CVE-2017-15687 | Medium | 6.1 | 2017-10-23 | DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI. |
CVE-2016-6257 | Medium | 6.5 | 2016-08-02 | The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wir… |
CVE-2012-1250 | | 2012-06-04 | Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges… | |
CVE-2008-0956 | | 2008-06-12 | Multiple stack-based buffer overflows in the BackWeb Lite Install Runner ActiveX control in the BackWeb Web Package ActiveX object in LiteInstActivator.dll in… | |
CVE-2007-2918 | | 2007-06-01 | Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) StarClient.dll, (4) Com… | |
CVE-2002-1722 | | 2002-12-31 | Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have… | |
CVE-2001-0737 | | 2001-10-18 | A long 'synch' delay in Logitech wireless mice and keyboard receivers allows a remote attacker to hijack connections via a man-in-the-middle attack. |