Atdog

Ocorre um estouro de buffer baseado em heap no Windows Hyper-V, o que permite que um invasor autorizado eleve privilégios localmente. Um estouro de buffer baseado em heap é uma condição em que um programa grava mais dados em um buffer de memória heap do que ele pode suportar, podendo levar à corrupção de memória.

A format string vulnerability in the IPSec VPN feature could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer. However, such an attack would require detailed knowledge of an affected device’s memory layout and configuration. The vulnerability is related to the use of uncontrolled format strings.

A format string vulnerability could allow an authenticated IPSec VPN user to cause DoS conditions against the `deviceid` daemon by sending a crafted hostname to an affected device if it has the `Device Insight` feature enabled. This issue is related to the use of uncontrolled format strings in the `Device Insight` feature of the affected devices.

The issue is related to a post-authentication command injection vulnerability in the file upload binary, allowing an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP. This can be achieved by exploiting the vulnerability in the file upload process, which does not properly neutralize special elements used in the command.

A null pointer dereference issue in the Anti-Malware feature of Zyxel ATP and USG FLEX series firmware could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host. This issue is related to pointer dereference errors and can be exploited by a remote attacker to cause a denial of service.

The issue is related to an integer overflow vulnerability in the QuickSec IPSec toolkit used in the VPN feature of various Zyxel devices. This vulnerability could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.

A buffer overflow vulnerability in the notification function could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device. The vulnerability is related to a lack of size checking for input data, which can be exploited by a remote attacker.

A format string vulnerability in the Zyxel firmware could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled. The vulnerability is related to the use of uncontrolled format strings, which may allow a remote attacker to execute arbitrary commands.

The issue is related to a command injection vulnerability in the configuration parser of the affected Zyxel devices. This vulnerability can be exploited by an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled. The exploitation occurs during an attempted `ip addr` command, and the order of operations is important for successful exploitation. It is estimated that out of approximately 7,600 devices using vulnerable firmware, around 607 were using the vulnerable configuration.

The configuration parser fails to sanitize user-controlled input in the affected Zyxel devices. An unauthenticated, LAN-based attacker could leverage this issue to inject operating system (OS) commands into the device configuration data on an affected device when the cloud management mode is enabled.

O problema está relacionado a uma vulnerabilidade de injeção de comando no comando CLI do firmware da Zyxel, que poderia permitir que um invasor autenticado com privilégios de administrador executasse comandos do sistema operacional. Isso se deve à falta de sanitização adequada de elementos especiais usados no comando do sistema operacional. A exploração dessa vulnerabilidade pode permitir que um invasor remoto execute comandos arbitrários.

**Nome do software vulnerável e versões afetadas: NETGEAR R7800 versão 1.0.2.76 Descrição: Esta vulnerabilidade permite que invasores na rede adjacente executem código arbitrário nas instalações afetadas. Não é necessária autenticação para explorar esta vulnerabilidade. A falha específica está no tratamento do código de operação DHCP `vendor specific`. A vulnerabilidade resulta da falta de validação adequada de uma string fornecida pelo usuário antes de usá-la para executar uma chamada de sistema. Um invasor pode aproveitar esta vulnerabilidade para executar código no contexto do root. Recomendações: Para o NETGEAR R7800 versão 1.0.2.76, considere aplicar um patch ou atualização que corrija a validação inadequada de strings fornecidas pelo usuário no tratamento do código de operação DHCP `vendor specific`. Como solução alternativa temporária, restrinja o acesso ao serviço DHCP para minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

O problema está relacionado a XSS refletido, que afeta determinados dispositivos NETGEAR.