Hongdian vendor intelligence

Hongdian Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting Hongdian products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse Hongdian KEVs Full KEV feed

Total KEVs: 3; Known exploited vulnerabilities affecting Hongdian products
In CISA KEV: 0; Records also listed in the official catalog
Beyond CISA KEV: 3; Additional exploited CVEs absent from CISA KEV
Sensor Observed: 0; Hongdian KEVs with sensor-observed exploitation activity

The catalog gap matters for Hongdian exposure

Three of the three exploited Hongdian CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 100% of this vendor portfolio.

0%
Covered by CISA: 100%
Beyond CISA: 1
Product families

Attested Hongdian CVEs

Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2021-28151 Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping...	H8922	High	Beyond CISA	04 Oct 2025
CVE-2021-28149 Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote...	H8922	High	Beyond CISA	06 May 2021
CVE-2021-28150 Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via...	H8922	High	Beyond CISA	06 May 2021

Showing 3 of 3 Hongdian known exploited vulnerabilities.

Recurring weakness patterns

Limitation, direct request ('forced browsing'), and neutralization account for three mapped occurrences across this Hongdian KEV portfolio.

Browse all KEVs →

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-425

Direct Request ('Forced Browsing')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.