Quentin Kaiser

توفر سلسلتا Netcom NTC 6200 وNWL 222 واجهة ويب للتكوين والإعداد من قبل المشغلين. تتعرض نقاط نهاية متعددة في واجهة الويب لخطر الحقن التعسفي للأوامر وتستخدم كلمات مرور غير آمنة مبرمجة بشكل ثابت. يمكن للمهاجمين البعيدين المصادق عليهم الحصول على تنفيذ تعسفي للرمز بامتيازات عالية.

تتعلق المشكلة بوجود ثغرة في واجهة ويب في سلسلة Diviotec الاحترافية، حيث تكون إحدى نقاط النهاية عرضة لحقن الأوامر بشكل تعسفي. بالإضافة إلى ذلك، يتم استخدام كلمات مرور مدمجة في الكود، مما يشكل خطرًا أمنيًا.

يمكن لمهاجم غير مصدق عليه على واجهة شبكة WAN، ولديه القدرة على اعتراض حركة مرور DNS الديناميكي (DDNS) بين خدمات DDNS والمودم، التلاعب بردود محددة لتضمين تعليمات برمجية تُحدث تجاوز سعة المخزن المؤقت في المودم. لا يمكن استغلال هذه المشكلة إلا في الأجهزة التي تم تفعيل خدمة DNS الديناميكي عليها. أما العملاء الذين لم يقوموا بتفعيل خدمة DNS الديناميكي في المودم الخاص بهم، فهم غير معرضين لهذه الثغرة.

يعرض الجهاز واجهة ويب على المنفذين TCP/3030 و TCP/9882، حيث يعمل عليه برنامج lighttpd الذي ينفذ واجهة ”SNORE“. تتأثر هذه الواجهة بثغرة أمنية تتمثل في تجاوز سعة المخزن المؤقت (buffer overflow) في المكدس (stack) بسبب تحليل المسار غير الآمن. يمكن للمهاجم الذي لديه وصول إلى واجهة شبكة LAN استخدام طلب HTTP مصمم خصيصًا لاستغلال تجاوز سعة المخزن المؤقت في المودم. قد تؤدي هذه الثغرة إلى تنفيذ التعليمات البرمجية عن بُعد وحجب الخدمة.

واجهة الويب الخاصة بـ Meteobridge معرضة لثغرة في حقن الأوامر. وهذا يسمح للمهاجمين عن بُعد غير المصادق عليهم بتنفيذ أوامر عشوائية بامتيازات عالية (root) على الأجهزة المتأثرة. تكمن الثغرة في واجهة الويب وتؤثر بشكل خاص على معالجة المدخلات في نقطة النهاية `/public/template.cgi`. يُذكر أن حوالي 100 جهاز معرض للإنترنت. وقد أشارت وكالة الأمن السيبراني والبنية التحتية (CISA) إلى أن هذه الثغرة (CVE-2025-4008) يتم استغلالها بشكل نشط في الواقع. تنبع هذه الثغرة من المعالجة غير الآمنة لنصوص CGI.

The issue affects devices that communicate with the eCharge cloud infrastructure over an insecure channel, as peer verification is disabled. This allows remote unauthenticated users, suitably positioned on the network between an EV charger controller and eCharge infrastructure, to execute arbitrary commands with elevated privileges on affected devices.

The issue affects the cph2 echarge firmware, allowing OS Command Injection due to an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.

Name of the Vulnerable Software and Affected Versions: TP-Link Archer C5400X versions prior to 1.1.7 TP-Link Archer C4500X versions through 1 1.1.6 Description: The issue is related to a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. This allows a remote unauthenticated attacker to gain arbitrary command execution on the device with elevated privileges. The problem is associated with the rftest binary file, which opens a network listener on TCP ports. Recommendations: For TP-Link Archer C5400X versions prior to 1.1.7, update to version 1.1.7 or later, which fixes the vulnerability by preventing the execution of commands with shell symbols. For TP-Link Archer C4500X versions through 1 1.1.6, consider disabling the "rftest" service as a temporary workaround until a patch is available. Restrict access to the vulnerable TCP ports (8888, 8889, and 8890) to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Ligowave UNITY versions through 6.95-2 Ligowave PRO versions through 6.95-1.Rt3883 Ligowave MIMO versions through 6.95-1.Rt2880 Ligowave APC Propeller versions through 2-5.95-4.Rt3352 Description: A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges. Recommendations: For Ligowave UNITY versions through 6.95-2, update to a version later than 6.95-2 to resolve the issue. For Ligowave PRO versions through 6.95-1.Rt3883, update to a version later than 6.95-1.Rt3883 to resolve the issue. For Ligowave MIMO versions through 6.95-1.Rt2880, update to a version later than 6.95-1.Rt2880 to resolve the issue. For Ligowave APC Propeller versions through 2-5.95-4.Rt3352, update to a version later than 2-5.95-4.Rt3352 to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users, which implements features affected by command injections and stack overflows. Successful exploitation of these flaws would allow remote attackers to gain remote code execution with elevated privileges on the affected devices. The interface's features, such as access control lists management and WPS pin setup, are vulnerable to these attacks.

The issue exists due to insufficient validation of user-supplied input in the web-based management interface, allowing an authenticated, remote attacker to perform command injection attacks. To exploit this, the attacker must have valid administrative credentials for the device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system by sending a crafted HTTP request to the web-based management interface.

The issue is related to a buffer overflow vulnerability in the web-based user interface of the affected devices. This vulnerability can be exploited by an authenticated, remote attacker who has valid administrative credentials for the device. The attacker can send a crafted HTTP request to the web-based management interface, potentially allowing them to execute arbitrary code as the root user on the underlying operating system. The vulnerability is due to insufficient validation of user-supplied input.

A vulnerability in WAGO products allows an unauthenticated, remote attacker to create new users and change the device configuration, which can result in unintended behavior, Denial of Service, and full system compromise. The issue is related to insufficient input validation, which can allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. Approximately 15,961 devices may be affected.

The NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges.

The NetModule NSRW web administration interface is susceptible to path traversal attacks. This could allow authenticated users to upload arbitrary files to the web root directory, potentially leading to remote command execution with elevated privileges.

A path traversal issue affects the yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.

A path traversal issue affects jefferson's JFFS2 filesystem extractor. Attackers can craft malicious JFFS2 files to force jefferson to write outside of the extraction directory.

The issue is related to path traversal when running against specifically crafted UBIFS files, allowing an attacker to overwrite files outside of the extraction directory if the process has write access. This occurs because a node name (`dent node.name`) is considered trusted and joined to the extraction directory path during processing, and then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g., ../../tmp/outside.txt), it's possible to force the software to write outside of the extraction directory.

binwalk is susceptible to a path traversal vulnerability. An attacker can exploit this by crafting a malicious PFS filesystem file, which allows them to extract files to arbitrary locations when binwalk is run in extraction mode (using the -e option). This can lead to remote code execution by extracting a malicious binwalk module into the `.config/binwalk/plugins` folder. The vulnerability is associated with the `src/binwalk/plugins/unpfs.py` file.

The issue allows a remote unauthenticated attacker to download a backup file, if one exists. This backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successful.