David Elze

A cross-site request forgery (CSRF) issue affects the cgi-bin/create user.cgi endpoint, allowing remote attackers to hijack administrator authentication for creating administrative accounts via a NEW USER action.

The issue allows remote authenticated users to execute arbitrary commands. This is achieved by leveraging guest access and placing shell metacharacters in the query string of the 'cgi-bin/pingping.cgi' endpoint.

The issue concerns a hardcoded guest account in the affected devices, allowing remote attackers to gain web-server login access.

The issue allows remote authenticated users to bypass intended access restrictions via the "/jmx-console" API endpoint, and then upload and execute arbitrary JSP code via a JBoss remote-deployment mechanism.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.

The issue concerns a lack of authorization requirements in the web service of the affected software. This allows remote authenticated users to perform database operations via a SOAP request. For example, this can be achieved through the "initializeQueryDatabase2" request.

The issue concerns the lack of authorization requirements for administrative functions, allowing remote authenticated users to perform administrative actions. This can be achieved by leveraging knowledge of a hidden function, such as the password-change function.

The issue allows remote authenticated users to gain privileges and obtain sensitive information by utilizing a modified desktop client.

The issue allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component. This is achieved by uploading crafted .war files due to improper restrictions. The attack can be performed via a crafted request to TCP port 1098, 1099, or 4444.

The issue allows context-dependent attackers to obtain sensitive information. This can be achieved by either sniffing the network for transmissions of Java objects or reading the database, as the software uses cleartext credentials for network communication and the internal database.