Shravan Singh

اسم البرنامج المعرض للثغرة والإصدارات المتأثرة: Panasonic IR Control Hub (IR Blaster) الإصدارات 1.17 وما قبلها الوصف: تسمح هذه الثغرة لمهاجم يتمتع بوصول مادي بتحميل برنامج ثابت غير مصرح به على الجهاز. التوصيات: بالنسبة للإصدارات 1.17 والإصدارات الأقدم، قم بالتحديث إلى إصدار أحدث من 1.17 لمنع تحميل برامج ثابتة غير مصرح بها. كحل مؤقت، ضع في اعتبارك تقييد الوصول المادي إلى الجهاز حتى يتوفر تصحيح.

تنشأ المشكلة بسبب تخزين بيانات الاعتماد في صيغة نصية عادية في البرنامج الثابت للجهاز. يمكن للمهاجم الذي يتمتع بوصول مادي استغلال هذه الثغرة عن طريق استخراج البرنامج الثابت وتحليل البيانات الثنائية للحصول على بيانات الاعتماد المخزنة في صيغة نصية عادية على الجهاز المعرض للخطر.

تنشأ هذه المشكلة بسبب مفتاح RSA خاص مدمج بشكل ثابت في البرنامج الثابت للجهاز. يمكن للمهاجم الذي يتمتع بوصول مادي استغلال هذه الثغرة للحصول على مفاتيح تشفير خاصة، والتي يمكن استخدامها بعد ذلك في انتحال الهوية وفك تشفير البيانات وشن هجمات «الرجل في الوسط» على الجهاز المستهدف.

تنشأ هذه الثغرة الأمنية نتيجة المعالجة غير الآمنة لعلامات ملفات تعريف الارتباط المستخدمة في واجهة الويب الخاصة بجهاز التوجيه CP Plus. يمكن لمهاجم عن بُعد استغلالها عن طريق اعتراض عمليات نقل البيانات أثناء جلسة HTTP على النظام المعرض للثغرة. قد يؤدي الاستغلال الناجح إلى تمكين المهاجم من الحصول على معلومات حساسة وتهديد أمن النظام المستهدف.

This issue exists due to the storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this by accessing its database, leading to unauthorized access of user information such as `username`, `email address`, and `mobile number`.

The issue exists due to the storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.

This issue is related to the storage of Wi-Fi credentials in plain text within the device firmware of Philips lighting devices. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device. Successful exploitation could allow an attacker to gain unauthorized access to the Wi-Fi network to which the vulnerable device is connected.

This issue exists due to a missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation could allow the attacker to capture cookies and obtain sensitive information on the targeted system.

The issue arises from a missing secure flag for session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation could allow the attacker to capture cookies and compromise the targeted system.

This issue exists due to the storage of default `username` and `password` credentials in plaintext within the router's firmware/database. An attacker with physical access could exploit this by extracting the firmware and reverse-engineering the binary data to access the plaintext default credentials. Successful exploitation could allow the attacker to gain unauthorized access to the targeted system.

The issue arises from the improper implementation of password policies. A local attacker could exploit this by creating passwords that do not adhere to the defined security standards or policy on the vulnerable system. Successful exploitation could allow the attacker to expose the router to potential security threats.

The issue exists due to the presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation could allow the attacker to execute arbitrary commands with root privileges on the targeted system.

The issue arises from the transmission of passwords in plain text. A remote attacker could exploit this by intercepting the transmission within an HTTP session on the vulnerable system. Successful exploitation could allow the attacker to gain unauthorized access to the targeted system.

This issue exists due to the unencrypted storage of WPA/WPS credentials within the router's firmware/database. An attacker with physical access could exploit this by extracting the firmware and reverse-engineering the binary data to access the plaintext WPA/WPS credentials. Successful exploitation could allow the attacker to bypass WPA/WPS and gain access to the Wi-Fi network of the targeted system.

This issue exists due to the storage of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineering the binary data to access the plaintext FTP credentials. Successful exploitation could allow the attacker to gain unauthorized access to the FTP server associated with the targeted system.

This issue is caused by the improper implementation of password policies. An attacker with physical access could exploit this by creating passwords that do not adhere to the defined security standards or policy on the vulnerable system. Successful exploitation could allow the attacker to expose the router to potential security threats.

This issue exists due to the presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation could allow the attacker to access sensitive information on the targeted system.

This issue is caused by the lack of encryption or hashing in storing passwords within the router's firmware/database. An attacker with physical access could exploit this by extracting the firmware and reverse-engineering the binary data to access plaintext passwords. Successful exploitation could allow the attacker to gain unauthorized access to the targeted system.

This issue is related to the lack of encryption in storing usernames and passwords within the router's firmware/database. An attacker with physical access could exploit this by extracting the firmware and reverse engineering the binary data to access the plaintext credentials on the vulnerable system. Successful exploitation could allow the attacker to gain unauthorized access to the targeted system.