Ilias Morad

قد يتمكن أحد التطبيقات من عرض قائمة بالتطبيقات المثبتة على جهاز المستخدم. تم حل هذه المشكلة من خلال تعزيز إجراءات التحقق.

An issue was discovered on certain ABUS TVIP devices due to a path traversal in the `/opt/cgi/admin/filewrite` API endpoint. This allows an attacker to write to files and thus execute code arbitrarily with root privileges.

Hardcoded manufacturer credentials and an OS command injection vulnerability in the "/cgi-bin/mft/" directory allow remote attackers to execute code as root.

The issue allows attackers to gain control of the program via a crafted string sent to the `sprintf()` function. This is a Buffer Overflow vulnerability in certain ABUS TVIP cameras.

An issue was discovered in certain ABUS TVIP cameras, where the CGI scripts allow remote attackers to execute code via `system()` as root. There are several injection points in various scripts.

The issue is related to incorrect access control, allowing unauthenticated remote attackers to view the "/video.mjpg" video stream.

A logic issue was addressed with improved validation, which may allow an application to gain elevated privileges.