Elspec-ltd G5dfr Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Elspec-ltd G5dfr Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (13)

• CVE-2024-22080 — CVSS 9.8 (critical): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur…
• CVE-2024-22081 — CVSS 9.8 (critical): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in…
• CVE-2024-22078 — CVSS 8.8 (high): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable…
• CVE-2024-46601 — CVSS 7.5 (high): Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow.
• CVE-2024-22079 — CVSS 7.5 (high): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs…
• CVE-2024-22082 — CVSS 7.5 (high): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the…
• CVE-2024-46602 — CVSS 7.5 (high): An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may…
• CVE-2024-22084 — CVSS 7.5 (high): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Cleartext passwords and hashes are exposed…
• CVE-2024-46603 — CVSS 7.5 (high): An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a…
• CVE-2025-59392 — CVSS 6.8 (medium): On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive…
• CVE-2024-22083 — CVSS 6.5 (medium): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can…
• CVE-2024-22085 — CVSS 6.2 (medium): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable.
• CVE-2024-22077 — CVSS 5.3 (medium): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions.