Ina Kheirkhah

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Autel MaxiCharger AC Wallbox Commercial (لم يتم تحديد الإصدارات المتأثرة) الوصف: تسمح هذه الثغرة للمهاجمين عن بُعد بالكشف عن معلومات حساسة في التثبيتات المتأثرة لمحطات الشحن Autel MaxiCharger AC Wallbox Commercial. توجد الثغرة المحددة في واجهة برمجة التطبيقات (Pile API)، وتنتج عن عدم وجود مصادقة قبل السماح بالوصول إلى الوظائف. يمكن للمهاجم استغلال هذه الثغرة للكشف عن بيانات الاعتماد، مما يؤدي إلى المزيد من الاختراق. التوصيات: في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

تتعلق المشكلة بثغرة أمنية تسمح بتنفيذ التعليمات البرمجية عن بُعد، ناتجة عن إعادة ترقية البرنامج الثابت إلى إصدار أقدم في جهاز Autel MaxiCharger AC Wallbox Commercial. لم يتم تقديم أي معلومات حول العدد التقديري للأجهزة التي قد تكون متأثرة أو الحوادث الفعلية التي تم فيها استغلال هذه المشكلة. كما لم يتم تحديد التفاصيل الفنية المتعلقة بكيفية الاستغلال.

تتعلق المشكلة بثغرة أمنية تتمثل في تجاوز المصادقة بسبب خطأ في التحقق من المصدر. وهذا يسمح بتجاوز المصادقة نتيجة لخطأ في التحقق من المصدر.

تتعلق المشكلة بثغرة أمنية تتمثل في الكشف عن المعلومات عبر طريقة خطيرة، حيث يتم الكشف عن الرقم التسلسلي التجاري. اكتشف هذه الثغرة سينا خيرخاه من فريق Summoning Team.

تتعلق المشكلة بثغرة أمنية تتمثل في تصعيد غير صحيح لصلاحيات التفويض في واجهة برمجة التطبيقات (API) الخاصة بالفنيين التجاريين في جهاز Autel MaxiCharger AC Wallbox. وقد اكتشف هذه الثغرة سينا خيرخاه من فريق Summoning Team خلال مسابقة Pwn2Own.

تسمح هذه الثغرة للمهاجمين المتواجدين فعليًا بالتحايل على عملية المصادقة في المنشآت المتأثرة التي تستخدم شاحن السيارات الكهربائية WOLFBOX من المستوى 2. يكمن الخلل المحدد في معالجة بطاقات الإدارة، نتيجة لعدم تخصيص هذه البطاقات. يمكن للمهاجم استغلال هذه الثغرة لتجاوز عملية المصادقة في النظام.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. No authentication is required to exploit this issue. The specific flaw exists within the `wlanapp` module, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. No authentication is required to exploit this issue. The specific flaw exists within the `onboardee` module and results from improper access control, allowing an attacker to execute code in the context of `root`.

The issue is related to the configuration of the ONVIF API in the D-Link DCS-8300LHV2 Wi-Fi camera, which is associated with weaknesses in the authentication procedure. This allows a remote attacker to bypass the authentication process. The specific flaw exists within the ONVIF API configuration, resulting from the use of a hardcoded PIN. An attacker can leverage this vulnerability to bypass authentication on the system.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. The flaw exists within the HTTP service listening on TCP port 80, due to the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. The issue can be exploited without requiring authentication.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

The issue is related to a stack-based buffer overflow in the cfgsave function of the HTTP service in D-Link G416 wireless routers. This can be exploited by a remote attacker to execute arbitrary code on the affected device. The vulnerability exists due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. The specific flaw exists within the HTTP service listening on TCP port 80.

The issue is related to a lack of proper validation of user-supplied strings before executing system calls, allowing network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. No authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80, and an attacker can leverage this vulnerability to execute code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

The issue exists due to the lack of proper validation of a user-supplied string before using it to execute a system call in the HTTP service listening on TCP port 80. This allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers with root privileges by sending a specially crafted HTTP request. Authentication is not required to exploit this vulnerability.

The issue is related to a command injection vulnerability in the nodered chmod function of the D-Link G416 router's firmware. This vulnerability can be exploited by a remote attacker to execute arbitrary code by connecting to TCP port 80. The problem arises from the lack of proper validation of a user-supplied string before using it to execute a system call, allowing an attacker to execute code in the context of root. No authentication is required to exploit this vulnerability.

The issue is related to the awsfile chmod function in the D-Link G416 router's firmware, which does not properly neutralize special elements used in an operating system command. This allows a remote attacker to execute arbitrary code by connecting to TCP port 80. The specific flaw exists within the HTTP service listening on TCP port 80, due to the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

The issue is related to a command injection vulnerability in the flupl pythonmodules of D-Link G416 wireless routers. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations. The specific flaw exists within the HTTP service listening on TCP port 80, due to the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.