Gabriel Gonzalez

A security issue was found in the Moog EXO Series units that support the ONVIF interoperability protocol. The authentication check for certain ONVIF operations can be bypassed, allowing an attacker to execute privileged operations without authentication. This could enable the creation of a new Administrator user.

The issue concerns several XML External Entity (XXE) vulnerabilities. These vulnerabilities allow remote unauthenticated users to read arbitrary files by using a crafted Document Type Definition (DTD) in an XML request.

The issue concerns a hardcoded credentials vulnerability, which could lead to confidentiality issues when using the FTP, Telnet, or SSH protocols.

The administration console of the Moog EXO Series units has a feature that allows spawning a process repeatedly at a certain time interval as 'root'. This feature can be exploited by using special shell variables, such as `${IFS}`, to execute arbitrary commands as 'root' on the units.