Microsoft

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

O consumo descontrolado de recursos permite que um invasor não autorizado cause a negação de serviço através de uma rede.

O problema diz respeito ao software Eaton Foreseer, que permite aos usuários personalizar o painel de controle em páginas WebView. No entanto, os campos de entrada desse recurso não possuem uma sanitização adequada do lado do servidor, o que pode levar à injeção e execução de scripts maliciosos quando explorados por agentes mal-intencionados.

O software Eaton Foreseer apresenta uma falha de segurança relacionada aos seus campos de entrada personalizáveis, que permitem aos usuários configurar parâmetros como alarmes e relatórios. Alguns desses campos de entrada não verificam o comprimento e os limites dos valores inseridos. A exploração dessa falha pode resultar em consumo excessivo de memória ou estouro de inteiros.