Julian Suleder

يؤدي الافتقار إلى المصادقة في «البروتوكول المخصص» (Custom Protocol) لشرائح Bluetooth من Airoha Technology إلى السماح بالوصول غير المصرح به إلى بروتوكول RACE. تتيح هذه الثغرة لمهاجم عن بُعد تجاوز القيود الأمنية وتحقيق تصعيد امتيازات عن بُعد دون الحاجة إلى امتيازات تنفيذ إضافية أو تفاعل من المستخدم. يمكن استغلال هذه المشكلة للحصول على وصول غير مصرح به والتنصت على سماعات الرأس المتأثرة.

تسمح ثغرة في عملية التفويض غير الصحيحة في Airoha Bluetooth audio SDK بإقران جهاز صوتي يعمل بتقنية Bluetooth دون موافقة المستخدم. تنشأ هذه المشكلة عن عدم وجود مصادقة لوظيفة حاسمة داخل مكون شريحة Bluetooth من نوع BR/EDR. يمكن لمهاجم قريب يقع ضمن نطاق البلوتوث استغلال هذه الثغرة للاتصال سراً بأجهزة لم يتم إقرانها بعد وتبحث بنشاط عن طلبات الإقران. وقد يؤدي ذلك إلى تصعيد الامتيازات عن بُعد وتمكين المهاجم من التنصت عبر ميكروفون الجهاز لأغراض المراقبة دون الحاجة إلى أي تفاعل من المستخدم أو امتيازات تنفيذ إضافية.

يوجد ثغرة في خدمة Bluetooth LE GATT تسمح بتجاوز الأذونات، مما يتيح الوصول غير المصرح به إلى بيانات حساسة تابعة لبروتوكول RACE. تنجم هذه المشكلة عن عدم وجود مصادقة لوظيفة حساسة، مما قد يسمح لمهاجم عن بُعد ضمن نطاق Bluetooth بتصعيد الامتيازات دون الحاجة إلى امتيازات تنفيذ إضافية أو تفاعل من المستخدم.

تم اكتشاف ثغرة أمنية في معالجة المؤشرات المتحركة. إذا لم يقم العميل بتوفير أي مؤشر، يفترض الخادم وجود مؤشر واحد على الأقل، مما يؤدي إلى قراءة خارج النطاق واحتمال تعطل النظام.

تم العثور على ثغرة في الملحق XFIXES. لا يقوم المعالج XFixesSetClientDisconnectMode بالتحقق من صحة حجم الطلب، مما يسمح للعميل بقراءة الذاكرة غير المخصصة من الطلبات السابقة.

تم اكتشاف ثغرة في ملحق Big Requests، حيث يتم ضرب طول الطلب في 4 قبل مقارنته بالحجم الأقصى المسموح به. وقد يؤدي ذلك إلى حدوث تجاوز سعة عدد صحيح، مما يسمح للمهاجم بالتحايل على فحص الحجم.

A relative path traversal attack allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file, an attacker can execute arbitrary commands.

A vulnerability allows attackers to recover user credentials of the administrative interface.

A XPath injection issue allows unauthenticated remote attackers to access sensitive information and escalate privileges.

The issue is related to improper access controls, allowing attackers to extract and tamper with the device's network configuration.

The issue allows access to sensitive endpoints without requiring authentication information, such as a session cookie. This enables an attacker to send requests to these endpoints as an unauthenticated user, potentially performing critical actions or modifying critical configuration parameters.

An attacker with physical access to the host can extract secrets from the registry and create valid JWT tokens for the application, allowing them to impersonate arbitrary users. This could also enable the manipulation of RabbitMQ queues and messages by impersonating users.

The issue allows user input to be validated on the client side without proper authentication by the server. This is problematic because the server should not rely solely on the correctness of the data sent by the client, as users may not support or block JavaScript, or could intentionally bypass the client-side checks. An attacker with knowledge of the service user could exploit this by circumventing the client-side control, potentially allowing them to login with service privileges.

The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-the-middle attackers to tamper with messages.

The Ypsomed mylife Cloud discloses password hashes during the registration process.

The Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint.

Name of the Vulnerable Software and Affected Versions: Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior Description: The issue is related to an XML validation vulnerability in the ventilator, allowing privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files. Recommendations: For Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior, consider restricting physical access to the device to prevent exploitation of the XML validation vulnerability until a patch is available. As a temporary workaround, consider disabling the upload of configuration files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Diabecare RS (affected versions not specified) AnyDana-i (affected versions not specified) AnyDana-A (affected versions not specified) Description: A client-side control issue in the insulin pump and its mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy. This could potentially affect a significant number of devices, although the exact number is not specified. Recommendations: For Diabecare RS, consider disabling Bluetooth Low Energy connectivity until a patch is available. For AnyDana-i, restrict access to the default PIN check functionality to minimize the risk of exploitation. For AnyDana-A, avoid using the default PIN configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SOOIL Developments Co., Ltd Diabecare RS (affected versions not specified) AnyDana-i (affected versions not specified) AnyDana-A (affected versions not specified) Description: The communication protocol of the insulin pump and its mobile applications uses deterministic keys, allowing unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low Energy. Recommendations: For SOOIL Developments Co., Ltd Diabecare RS, consider restricting Bluetooth Low Energy access to minimize the risk of exploitation. For AnyDana-i, restrict access to the mobile application's communication protocol until a patch is available. For AnyDana-A, avoid using the deterministic keys in the communication protocol until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Diabecare RS (affected versions not specified) AnyDana-i (affected versions not specified) AnyDana-A (affected versions not specified) Description: A client-side control issue in the insulin pump and its mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy. This affects the Diabecare RS, AnyDana-i, and AnyDana-A products. Recommendations: For Diabecare RS, consider disabling Bluetooth Low Energy connectivity until a patch is available. For AnyDana-i, restrict access to the mobile application's authentication features to minimize the risk of exploitation. For AnyDana-A, avoid using the device in areas where physically proximate attackers could bypass user authentication checks via Bluetooth Low Energy until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.