Swing

The issue is related to a buffer overflow caused by an authenticated user, which can lead to a denial of service or the execution of arbitrary code. This occurs due to the lack of size checking for input data.

The issue is related to multiple vulnerabilities in the web-based management interface of the affected routers. These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service (DoS) condition, or execute arbitrary commands. The exploitation can be done by sending a specially crafted HTTP request.

The vulnerability in the web-based management interface of the affected routers is related to errors in handling HTTP requests, specifically with syntax quoting neutralization. This could allow a remote attacker to execute arbitrary commands by sending a specially crafted HTTP request. The issue may enable an attacker to execute arbitrary code, cause a denial of service (DoS) condition, or execute arbitrary commands.

The issue is caused by an integer overflow in the RNDIS packet parsing routines, allowing a malicious USB device to trigger disclosure of unrelated kernel memory to userspace applications on the host or cause the kernel to crash. Kernel memory disclosure is more likely on 32-bit kernels, while 64-bit kernels are more likely to crash during attempted exploitation. The vulnerability is located in the `HoRNDIS::receivePacket` function, where variables `msg len`, `data ofs`, and `data len` can be controlled by an attached USB device. A negative value of `data ofs` can bypass the check for `(data ofs + data len + 8) > msg len`, leading to a wild pointer copy in the `mbuf copyback` call.

The issue is related to command injection in the system mgr.cgi component, which can lead to remote arbitrary code execution. This occurs due to errors in neutralizing special elements in the OS command. The exploitation of this issue can allow a remote attacker to execute arbitrary code.