Viloliving operates in a narrow product space centered on the Vilo 5 device and its firmware, which despite modest volume carries a high-prominence profile in its market segment. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur across authentication bypass, buffer-overflow, cleartext transmission, output-encoding, and cross-site scripting weaknesses—a pattern suggesting inadequate input validation, weak access controls, and insecure data-handling practices endemic to the embedded device class. Defenders should prioritize Vilo 5 deployments for firmware patching and restrict device exposure; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Viloliving over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-40087CRITICAL Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers t | Oct 21, 2024 | 9.6 | 28 | NO | NO |
CVE-2024-40084CRITICAL A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP method | Oct 21, 2024 | 9.6 | 28 | NO | NO |
CVE-2024-40089CRITICAL A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name | Oct 21, 2024 | 9.1 | 27 | NO | NO |
CVE-2024-40091MEDIUM Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system. | Oct 21, 2024 | 5.3 | 19 | NO | NO |
CVE-2024-40088MEDIUM A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of a | Oct 21, 2024 | 5.3 | 19 | NO | NO |
CVE-2024-40090MEDIUM Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers to leak memory addre | Oct 21, 2024 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Viloliving.
Media articles that mention a CVE ID that affects a product developed by Viloliving — matched by CVE ID, not by vendor name.