Xiapu Luo

A command injection issue exists in the `pingtrace` function due to insufficient validation of the `host` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host machine.

A pre-authentication null pointer dereference occurs in the 'setget.cgi' interface. This issue stems from missing validation when the `pass` field is absent. A remote attacker can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

A command injection issue exists in the `dray apm` component. The flaw stems from insufficient validation of UDP message content following a `START SPEED TEST` request before the system executes commands. A remote attacker can exploit this by sending a specially crafted message to execute arbitrary commands with root privileges.

A command injection issue exists in the `commandTable()` function. The flaw stems from incomplete filtering of dangerous characters, including backticks, newline characters, and single quotes, within the `parameter` field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `sysreboot()` function. The flaw stems from insufficient filtering of the `config`, `act`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A pre-authentication command injection issue exists in the 'setget.cgi' interface. The flaw stems from insufficient filtering of the `pass` field before command execution, allowing a remote attacker to execute arbitrary commands with root privileges via crafted input.

A buffer overflow exists in the `setLan()` function due to missing length checks during memory copy operations. This issue affects the `lanVlanId0`, `lanIp`, and `lanNetmask` fields. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to cause a denial of service or execute arbitrary commands.

A command injection issue exists in the `apautotest()` function. The flaw stems from insufficient validation of the `CMD0`, `CMD3`, and `CMD6` fields before they are executed as commands. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the 'upload settings.cgi' interface. The flaw occurs due to insufficient filtering of the `restorekey` field before it is concatenated into a shell command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `jsonstatus()` function. The flaw stems from insufficient filtering of the `usescript`, `usefile`, and `option` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `webBackupAction()` function. The flaw stems from insufficient filtering of the `option`, `key`, `pw encode`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

يسمح نظام إدارة الموارد الشخصية Volmarg للمهاجمين المصادق عليهم بقراءة ملفات عشوائية عبر نقطة النهاية ’GET /public/get-file/{path}‘. يتم تمرير معلمة المسار `path` إلى الدالة `file get contents()` دون إجراء عملية التوحيد (canonicalization)، وهي عملية تحويل المسار إلى أبسط صيغة قياسية له، مما يسمح باسترداد الملفات الحساسة التي يمكن لعملية PHP-FPM الوصول إليها. تحتوي طرازات DrayTek VigorAP على ثغرة حقن الأوامر في الدالة `ExportSettings()`. يؤدي التصفية غير الكافية لحقول `backupkey` و`backuptype` و`realtime` إلى تمكين المهاجم عن بُعد الذي يمتلك بيانات اعتماد إدارية من تنفيذ أوامر عشوائية بامتيازات الجذر.

A command injection issue exists in the `tr069TestInform()` function. The flaw arises from insufficient filtering of dangerous characters before the `event code` field is concatenated into a system command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A null pointer dereference occurs in the `formlogout()` function due to missing checks for an empty or absent Cookie header before string handling. A remote attacker with valid administrative credentials for the web management interface can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

A command injection issue exists in the `setcamset()` function. The flaw stems from insufficient filtering of the `selectSlaves` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `setLan()` function. The flaw stems from insufficient validation of the `lanIp` and `lanNetmask` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `mesh start speed test()` function. The flaw stems from insufficient sanitization of the `meshdevice index` and `meshdevice ip` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `InquierTime()` function. The flaw stems from insufficient filtering of the `time` field before it is used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A buffer overflow exists in the `apautotest()` function. The issue stems from missing length checks during memory copy operations involving the `CMD6` field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to trigger a denial of service or execute arbitrary commands.

A command injection issue exists in the `auth set()` function. The flaw stems from insufficient filtering of the `username` and `password` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host.