Roberto Paleari

يحتوي جهاز التوجيه NETGEAR DGN1000 على ثغرة تسمح بالتحايل على عملية المصادقة من خلال استخدام مسار أو قناة بديلة. يتيح استغلال هذه الثغرة لمهاجم بعيد وغير مصادق عليه تنفيذ أوامر تعسفية لنظام التشغيل بصفة الجذر (root) عن طريق إرسال طلبات HTTP مصممة خصيصًا إلى **نقطة نهاية واجهة برمجة التطبيقات (API)** `setup.cgi`. وقد تم استغلال هذه الثغرة بشكل نشط في الواقع منذ عام 2017 على الأقل، بما في ذلك نشاط رصدته مؤسسة Shadowserver في 6 فبراير 2025 بالتوقيت العالمي المنسق (UTC). تسمح هذه الثغرة للمهاجمين بالتفاعل مع خدمات الخلفية للموجه دون الحاجة إلى بيانات اعتماد، وذلك باستخدام عناوين URL تحتوي على السلسلة الفرعية ”currentsetting.htm“.

Name of the Vulnerable Software and Affected Versions: Netgear WNR1000v3 versions prior to 1.0.2.60 Description: The issue concerns an authentication bypass via the `NtgrBak` key. This allows unauthorized access, potentially leading to further exploitation. Recommendations: For versions prior to 1.0.2.60, update the firmware to version 1.0.2.60 or later to resolve the issue. As a temporary workaround, consider restricting access to the router until the update can be applied.

Name of the Vulnerable Software and Affected Versions: Netgear WNR1000v3 versions prior to 1.0.2.60 Description: The issue is related to an Authentication Bypass in the Netgear WNR1000v3 router. This occurs because the server skips checks for URLs containing a ".jpg". There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. Recommendations: For versions prior to 1.0.2.60, update the firmware to version 1.0.2.60 or later to resolve the issue. As a temporary workaround, consider restricting access to URLs containing a ".jpg" to minimize the risk of exploitation.

The issue allows an attacker to access the modem in USB configuration number 2 while the device is in a secure lockscreen state. This unintended availability enables the attacker to make phone calls, send text messages, or issue commands.

The issue allows attackers to bypass URL filtering by inserting an exceptional URL in the query string. For example, the URL 'http://should-have-been-filtered.example.com/?http://google.com' can be used to bypass filtering.

The issue allows attackers to modify Android settings by leveraging AT access. This is possible because the devices do not block AT+USBDEBUG and AT+WIFIVALUE.

The issue allows attackers to send AT commands by plugging the device into a Linux host.

The issue allows attackers to read sent e-mail messages.

The issue concerns a NULL pointer dereference that can be triggered via a "GET HTTP/1.1" request. This is related to the getURL function in drivers/secfilter/urlparser.c in secfilter.

The issue allows directory traversal in a Kies restore.

The issue is related to SQL injection.

The issue allows remote attackers to discover credentials by reading detailed error messages.

The issue allows attackers to bypass filesystem encryption via XOR calculations.

The issue allows remote attackers to read arbitrary files by sending a request to an unspecified PHP script.

The issue makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage. Encryption keys are stored in the system, allowing an attacker to implement reverse engineering to obtain the encryption keys.

The issue allows remote authenticated administrators to obtain and decrypt passwords by leveraging the selection of a reversible encryption algorithm. This is caused by improper encryption mechanisms in some Huawei products, where users can choose between reversible or irreversible encryption algorithms to encrypt passwords. If a reversible encryption algorithm is used, an attacker with high administrative privileges can log in to the device, obtain the ciphertext password of a higher-level administrator, and potentially crack it to gain elevated privileges.

The issue is related to the Bluetooth subsystem in the operating system, which lacks protection of service data. This allows attackers to obtain sensitive kernel memory-layout information via a crafted app, potentially giving a remote attacker access to protected information.

The issue is related to a buffer overflow in the ntfs component, allowing local users to gain privileges or cause a denial of service due to memory corruption.

The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service via a crafted app, specifically due to a problem in the FireWire driver in IOFireWireFamily.

The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption via a crafted app. This is related to the Bluetooth HCI interface implementation.