Fabius Watson

O problema está relacionado à validação inadequada de certificados nos utilitários LDAP, permitindo que atacantes do tipo man-in-the-middle sequestram a autenticação de administradores.

Foi relatada uma vulnerabilidade de autenticação inadequada que afeta várias versões do sistema operacional QNAP. Se explorada, a vulnerabilidade poderia permitir que invasores remotos comprometessem a segurança do sistema.

Um invasor remoto não autenticado pode interferir na comunicação devido à falta de criptografia de dados confidenciais por meio de um ataque Man-In-The-Middle (MITM). O carregamento não é afetado.

Um invasor remoto não autenticado pode realizar uma injeção de log devido a uma validação inadequada de entradas. Apenas um determinado arquivo de log é afetado.

Nome do software vulnerável e versões afetadas: Phoenix Contact CHARX SEC-3100 (versões afetadas não especificadas) Descrição: A vulnerabilidade existe devido à validação insuficiente de entradas no serviço OCPP, permitindo que um invasor remoto não autenticado execute injeção de comando com privilégios limitados. Isso pode potencialmente permitir que o invasor execute comandos arbitrários. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. This issue exists because of insufficient input validation, which may allow an attacker to elevate their privileges and execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Verix Multi-app Conductor application version 2.7 Description: The issue allows attackers to execute arbitrary code via a long configuration key value, specifically through a buffer overflow. To exploit this, an attacker must have the capability to download files to the device. Recommendations: For version 2.7, consider restricting access to configuration key values to prevent exploitation until a fix is available. As a temporary workaround, limit the ability to download files to the device to minimize the risk of exploitation.

The issue concerns a remote code execution vulnerability in the OrionModuleEngine service, which establishes a NetTcpBinding endpoint allowing remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method can be abused by an attacker to execute commands as the SYSTEM user. There have been reports of real-world incidents where this issue was exploited, with hackers compromising the network of a strategic IT solutions provider for American government organizations. It is estimated that multiple hacking groups may have exploited this vulnerability, with one group using an exploit similar to a previously known vulnerability to infect SolarWinds Orion installations that were open to the network.

The issue concerns a privilege escalation problem in the "SaferVPN.Service" service of SaferVPN for Windows. This service runs "openvpn.exe" using configuration files from the user's %LOCALAPPDATA%SaferVPNOvpnConfig directory. An authenticated attacker can modify these configuration files to specify a dynamic library plugin that runs for every new VPN connection attempt, allowing the execution of code in the context of the SYSTEM user.

The issue allows for SYSTEM privilege escalation through the "VyprVPN" service, which establishes a NetNamedPipe endpoint. This endpoint exposes methods that can be called by applications, including the `SetProperty` method. This method enables an attacker to configure the `AdditionalOpenVpnParameters` property, thereby controlling the OpenVPN command line. An attacker can use the OpenVPN `plugin` parameter to specify a dynamic library plugin that runs for every new VPN connection attempt, executing code in the context of the SYSTEM user. The attack can be conducted using "VyprVPN Free" account credentials and the VyprVPN Desktop Client.

The issue concerns a privilege escalation through the "CG6Service" service, which sets up a NetNamedPipe endpoint. This allows any installed application to connect and invoke publicly exposed methods. Specifically, the "ConnectToVpnServer" method is vulnerable as it accepts a `connectionParams` argument, giving an attacker control over the OpenVPN command line. An attacker can specify a dynamic library plugin to run for every new VPN connection attempt, executing code in the context of the SYSTEM user.

Name of the Vulnerable Software and Affected Versions: TunnelBear version 3.2.0.6 Description: The issue concerns a privilege escalation through the TunnelBearMaintenance service, which sets up a NetNamedPipe endpoint. This allows any installed application to connect and invoke publicly exposed methods. Specifically, the OpenVPNConnect method is vulnerable as it accepts a server list argument, giving an attacker control over the OpenVPN command line. An attacker can specify a dynamic library plugin to run for every new VPN connection attempt, executing code in the context of the SYSTEM user. Recommendations: For TunnelBear version 3.2.0.6, consider disabling the TunnelBearMaintenance service as a temporary workaround until a patch is available. Restrict access to the NetNamedPipe endpoint to minimize the risk of exploitation. Avoid using the OpenVPNConnect method in the affected service until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: PureVPN version 6.0.1 Description: The issue concerns a privilege escalation in the `sevpnclient` service when using the OpenVPN protocol. The service executes `openvpn.exe` with a config file located at `%PROGRAMDATA%purevpnconfigconfig.ovpn`, which has write permissions for the `Everyone` group. An authenticated attacker can modify this file to specify a dynamic library plugin, allowing code execution in the context of the SYSTEM account. Recommendations: For PureVPN version 6.0.1, consider restricting write access to the `%PROGRAMDATA%purevpnconfigconfig.ovpn` file to prevent modification by unauthorized users. As a temporary workaround, monitor changes to this file closely and avoid using the OpenVPN protocol until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: London Trust Media Private Internet Access (PIA) VPN Client version v77 Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client could allow an unauthenticated, local attacker to run executable files with elevated privileges due to insufficient implementation of access controls. The `Changelog` and `Help` options from the system tray context menu spawn an elevated instance of the user's default web browser. An attacker could exploit this by selecting `Run as Administrator` from the context menu of an executable file within the file browser of the spawned default web browser, potentially allowing the execution of privileged commands on the targeted system. Recommendations: For London Trust Media Private Internet Access (PIA) VPN Client version v77, consider disabling the `Changelog` and `Help` options from the system tray context menu as a temporary workaround until a patch is available. Restrict access to the default web browser's file browser to minimize the risk of exploitation. Avoid using the `Run as Administrator` option from the context menu of executable files within the spawned default web browser until the issue is resolved.

The issue is related to the "nordvpn-service" service, which establishes a NetNamedPipe endpoint. This allows arbitrary installed applications to connect and call publicly exposed methods, including the "Connect" method. The "Connect" method accepts a class instance argument, providing attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin to run for every new VPN connection attempt, executing code in the context of the SYSTEM user. The vulnerability is associated with inadequate access control in the nordvpn-service.

The issue is related to insufficient access control in the ProtonVPN service, which establishes a NetNamedPipe endpoint. This allows arbitrary installed applications to connect and call publicly exposed methods, such as the `Connect` method. The `Connect` method accepts a class instance argument, providing attacker control over the OpenVPN command line. An attacker can specify a dynamic library plugin to execute code in the context of the SYSTEM user. This could allow a remote attacker to execute arbitrary code with SYSTEM privileges using the OpenVPN command line.