Karn Ganeshen

A problematic issue was found, affecting the pgAdmin4 component. This issue leads to an uncontrolled search path and can be initiated remotely. The exploit has been disclosed to the public and may be used.

An uncontrolled search path element, also known as DLL Hijacking, issue has been identified. This could allow an attacker to gain access to the system with the same level of privilege as the application using the malicious DLL.

The issue affects the web administrative console of the firmware, where the 'ping' and 'traceroute' functions expose a file path traversal vulnerability. This vulnerability is accessible to all authenticated users.

The issue concerns an undocumented, root-privilege administration web shell accessible via a specific HTTP path. This path is "https://<device-ip-or-hostname>/adm/syscmd.asp".

The issue allows access to sensitive information through the SNMP read-only community string by OID reference.

The issue allows all authenticated users to update the Device Name and System Description fields in the web administration console. These fields are vulnerable to persistent cross-site scripting (XSS) injection.

The issue allows an attacker who knows or can guess the RW community string to provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs. The attacker can serve this file via HTTP, and the affected device will perform a configuration restore using the attacker's supplied config file, including the inserted XSS strings.

The issue allows an attacker who knows or guesses the SNMP read/write community string to insert XSS strings in certain SNMP OIDs, which will execute in the context of the currently logged-on user.

The issue allows a low-privilege 'user' account to access the configuration file via direct object reference (DOR) at the "http://<device-ip-or-hostname>/goform/down cfg file" endpoint, despite this option not being available in the normal web administrative console.

The issue is related to the lack of CSRF controls, which can be mitigated by implementing randomized per-session tokens associated with any web application function, especially destructive ones. This lack of control makes the system susceptible to CSRF attacks.

The issue allows non-administrative users, specifically 'installer' and 'home', to change passwords for other accounts, including administrative ones, by bypassing a client-side protection mechanism.

The issue is related to a lack of input sanitation for certain parameters on the web management console. This allows any authenticated user, including low-privilege readonly users, to inject shell meta-characters as part of a specially-crafted POST request to the `get chart` function and run OS-level commands, effectively as root.

A security issue was found related to an unquoted search path or element. This could potentially allow a local user with authorization to insert arbitrary code into the service path, leading to privilege escalation.

The issue allows user accounts to have multiple valid `username` and `password` pairs. This enables remote authenticated users to login to a target account via any of its `username` and `password` pairs.

The issue allows remote authenticated non-administrator users to change the admin password. This is achieved by intercepting an outgoing password change request and modifying the `username` parameter from `support` to `admin`.

The issue allows remote authenticated users to obtain user passwords by displaying user information in a Telnet connection.

A Directory Traversal issue was discovered, allowing an attacker to potentially use a simple GET request to perform a directory traversal into system files, leading to information disclosure.

A Stack-based Buffer Overflow issue was discovered. Opening a maliciously crafted html file may cause a stack overflow.

The issue is related to the lack of privilege separation.

The issue is related to weak credential management.