Jeff Luo

A memory corruption issue in PAN-OS software allows an unauthenticated attacker to crash the system due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode. The vulnerability is actively exploited in the wild.

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Researchers detected vulnerable devices from 289,665 separate IP addresses. The vulnerability is related to the Quick.cgi file and can be exploited by sending a request to the "/cgi-bin/quick/quick.cgi" endpoint. The `todo` parameter, specifically the `set timeinfo` value, and the `SPECIFIC SERVER` variable are involved in the exploitation. The vulnerability allows an attacker to execute arbitrary commands, potentially leading to a remote code execution attack.