EZCast vulnerabilities

🔔 Create alert RSS

Published CVEs affecting EZCast products: 7 record(s), with severity, exploitation and fixes.

EZCast Pro II 7

Exploited only (KEV) →

CVE-2026-24348 Medium · 6.1 CWE-79 Jan 27, 2026

Multiple cross-site scripting vulnerabilities in EZCast Pro II Dongle

Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScript code in the browser of other Admin UI users.

CVE-2026-24347 Medium · 5.3 CWE-20 Jan 27, 2026

Arbitrary file write to /tmp directory in EZCast Pro II Dongle

Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory

CVE-2026-24346 Critical · 9.1 CWE-798 Jan 27, 2026

Use of well-known default credentials in EZCast Pro II Dongle

Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web application

CVE-2026-24345 High · 8.8 CWE-352 Jan 27, 2026

Cross-Site Request Forgery in EZCast Pro II Dongle

Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI

CVE-2026-24344 High · 7.3 CWE-120 Jan 27, 2026

Multiple Buffer Overflows in EZCast Pro II Dongle

Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote code execution

CVE-2025-13955 Critical · 9.3 CWE-330 Dec 10, 2025

Predictable Default Wi-Fi Password in EZCast Pro II Dongle

Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range to gain access to the dongle by calculating the default password from observable device identifiers

CVE-2025-13954 Critical · 9.3 CWE-798 Dec 10, 2025

Hard-coded cryptographic keys in EZCast Pro II Dongle

Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to the admin UI