Roberto Paleari

**Nome do Software Vulnerável e Versões Afetadas** NETGEAR DGN1000 versões anteriores a 1.1.00.48 **Descrição** O roteador NETGEAR DGN1000 contém uma falha que permite contornar o processo de autenticação através do uso de um caminho ou canal alternativo. A exploração deste problema permite que um atacante remoto e não autenticado execute comandos arbitrários do sistema operacional como root enviando solicitações HTTP especialmente criadas para o `setup.cgi` **Endpoint de API**. Esta vulnerabilidade tem sido ativamente explorada na natureza desde pelo menos 2017, incluindo atividade observada pela Shadowserver Foundation em 2025-02-06 UTC. A vulnerabilidade permite que atacantes interajam com os serviços de backend do roteador sem credenciais, utilizando URLs contendo a substring"currentsetting.htm". **Recomendações** Para versões do NETGEAR DGN1000 anteriores a 1.1.00.48, atualize o firmware para a versão 1.1.00.48 ou posterior.

**Nome do software vulnerável e versões afetadas: Netgear WNR1000v3, versões anteriores à 1.0.2.60 Descrição: O problema diz respeito a uma falha de autenticação por meio da chave `NtgrBak`. Isso permite o acesso não autorizado, podendo levar a explorações adicionais. Recomendações: Para versões anteriores à 1.0.2.60, atualize o firmware para a versão 1.0.2.60 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso ao roteador até que a atualização possa ser aplicada.

**Nome do software vulnerável e versões afetadas: Netgear WNR1000v3, versões anteriores à 1.0.2.60 Descrição: O problema está relacionado a uma falha de autenticação no roteador Netgear WNR1000v3. Isso ocorre porque o servidor ignora as verificações de URLs que contenham a extensão “.jpg”. Não há informações disponíveis sobre o número estimado de dispositivos potencialmente afetados em todo o mundo nem detalhes sobre incidentes reais em que essa vulnerabilidade tenha sido explorada. Recomendações: Para versões anteriores à 1.0.2.60, atualize o firmware para a versão 1.0.2.60 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso a URLs que contenham “.jpg” para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Samsung SM-G920F versions G920FXXU2COH2 Samsung SM-N9005 versions N9005XXUGBOK6 Samsung GT-I9192 versions I9192XXUBNB1 Samsung GT-I9195 versions I9195XXUCOL1 Samsung GT-I9505 versions I9505XXUHOJ2 **Description** The issue allows an attacker to access the modem in USB configuration number 2 while the device is in a secure lockscreen state. This unintended availability enables the attacker to make phone calls, send text messages, or issue commands. **Recommendations** For Samsung SM-G920F version G920FXXU2COH2, update to a version that fixes the issue. For Samsung SM-N9005 version N9005XXUGBOK6, update to a version that fixes the issue. For Samsung GT-I9192 version I9192XXUBNB1, update to a version that fixes the issue. For Samsung GT-I9195 version I9195XXUCOL1, update to a version that fixes the issue. For Samsung GT-I9505 version I9505XXUHOJ2, update to a version that fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung kernel for Android versions on SM-N9005 build N9005XXUGBOB6 and SM-G920F build G920FXXU2COH2 **Description** The issue allows attackers to bypass URL filtering by inserting an exceptional URL in the query string. For example, the URL 'http://should-have-been-filtered.example.com/?http://google.com' can be used to bypass filtering. **Recommendations** For SM-N9005 build N9005XXUGBOB6, update the software to a version that fixes this issue. For SM-G920F build G920FXXU2COH2, update the software to a version that fixes this issue. As a temporary workaround, consider restricting access to URLs that contain query strings with exceptional URLs until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Samsung SM-G920F versions G920FXXU2COH2 Samsung SM-N9005 versions N9005XXUGBOK6 Samsung GT-I9192 versions I9192XXUBNB1 Samsung GT-I9195 versions I9195XXUCOL1 Samsung GT-I9505 versions I9505XXUHOJ2 **Description** The issue allows attackers to modify Android settings by leveraging AT access. This is possible because the devices do not block AT+USBDEBUG and AT+WIFIVALUE. **Recommendations** For Samsung SM-G920F version G920FXXU2COH2, restrict access to AT commands to minimize the risk of exploitation. For Samsung SM-N9005 version N9005XXUGBOK6, avoid using AT+USBDEBUG and AT+WIFIVALUE commands until the issue is resolved. For Samsung GT-I9192 version I9192XXUBNB1, consider disabling AT access as a temporary workaround until a patch is available. For Samsung GT-I9195 version I9195XXUCOL1, restrict the use of AT+WIFIVALUE command to prevent modification of Android settings. For Samsung GT-I9505 version I9505XXUHOJ2, disable AT+USBDEBUG command to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Samsung SM-G920F versions G920FXXU2COH2 Samsung SM-N9005 versions N9005XXUGBOK6 Samsung GT-I9192 versions I9192XXUBNB1 Samsung GT-I9195 versions I9195XXUCOL1 Samsung GT-I9505 versions I9505XXUHOJ2 **Description** The issue allows attackers to send AT commands by plugging the device into a Linux host. **Recommendations** For Samsung SM-G920F version G920FXXU2COH2, update to a newer version that contains a fix for this issue. For Samsung SM-N9005 version N9005XXUGBOK6, update to a newer version that contains a fix for this issue. For Samsung GT-I9192 version I9192XXUBNB1, update to a newer version that contains a fix for this issue. For Samsung GT-I9195 version I9195XXUCOL1, update to a newer version that contains a fix for this issue. For Samsung GT-I9505 version I9505XXUHOJ2, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices **Description** The issue allows attackers to read sent e-mail messages. **Recommendations** For Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Samsung kernel for Android versions on SM-N9005 build N9005XXUGBOB6 and SM-G920F build G920FXXU2COH2 **Description** The issue concerns a NULL pointer dereference that can be triggered via a "GET HTTP/1.1" request. This is related to the getURL function in drivers/secfilter/urlparser.c in secfilter. **Recommendations** For SM-N9005 build N9005XXUGBOB6, consider disabling the getURL function in drivers/secfilter/urlparser.c until a patch is available. For SM-G920F build G920FXXU2COH2, restrict access to the secfilter module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Samsung wssyncmlnps versions before 2015-10-31 **Description** The issue allows directory traversal in a Kies restore. **Recommendations** For versions before 2015-10-31, update to a version released after 2015-10-31 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices **Description** The issue is related to SQL injection. **Recommendations** For Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Web Viewer version 1.0.0.193 **Description** The issue allows remote attackers to discover credentials by reading detailed error messages. **Recommendations** For Web Viewer version 1.0.0.193, consider restricting access to detailed error messages as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Web Viewer version 1.0.0.193 **Description** The issue allows attackers to bypass filesystem encryption via XOR calculations. **Recommendations** For version 1.0.0.193, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Web Viewer version 1.0.0.193 **Description** The issue allows remote attackers to read arbitrary files by sending a request to an unspecified PHP script. **Recommendations** For Web Viewer version 1.0.0.193, consider restricting access to the unspecified PHP script until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Huawei AR routers versions prior to V200R007C00SPC100 Quidway S9300 routers versions prior to V200R009C00 S12700 routers versions prior to V200R008C00SPC500 S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00 S5700 routers versions prior to V200R007C00SPC500 **Description** The issue makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage. Encryption keys are stored in the system, allowing an attacker to implement reverse engineering to obtain the encryption keys. **Recommendations** For Huawei AR routers versions prior to V200R007C00SPC100, update to V200R007C00SPC100 or later. For Quidway S9300 routers versions prior to V200R009C00, update to V200R009C00 or later. For S12700 routers versions prior to V200R008C00SPC500, update to V200R008C00SPC500 or later. For S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00, update to V200R007C00 or later. For S5700 routers versions prior to V200R007C00SPC500, update to V200R007C00SPC500 or later.

**Name of the Vulnerable Software and Affected Versions** Huawei AR routers versions prior to V200R007C00SPC100 Quidway S9300 routers versions prior to V200R009C00 S12700 routers versions prior to V200R008C00SPC500 S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00 S5700 routers versions prior to V200R007C00SPC500 **Description** The issue allows remote authenticated administrators to obtain and decrypt passwords by leveraging the selection of a reversible encryption algorithm. This is caused by improper encryption mechanisms in some Huawei products, where users can choose between reversible or irreversible encryption algorithms to encrypt passwords. If a reversible encryption algorithm is used, an attacker with high administrative privileges can log in to the device, obtain the ciphertext password of a higher-level administrator, and potentially crack it to gain elevated privileges. **Recommendations** For Huawei AR routers versions prior to V200R007C00SPC100, update to V200R007C00SPC100 or later. For Quidway S9300 routers versions prior to V200R009C00, update to V200R009C00 or later. For S12700 routers versions prior to V200R008C00SPC500, update to V200R008C00SPC500 or later. For S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00, update to V200R007C00 or later. For S5700 routers versions prior to V200R007C00SPC500, update to V200R007C00SPC500 or later.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.5 **Description** The issue is related to the Bluetooth subsystem in the operating system, which lacks protection of service data. This allows attackers to obtain sensitive kernel memory-layout information via a crafted app, potentially giving a remote attacker access to protected information. **Recommendations** For versions prior to 10.10.5, update to version 10.10.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of Bluetooth functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.5 **Description** The issue is related to a buffer overflow in the ntfs component, allowing local users to gain privileges or cause a denial of service due to memory corruption. **Recommendations** For versions prior to 10.10.5, update to version 10.10.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.4 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service via a crafted app, specifically due to a problem in the FireWire driver in IOFireWireFamily. **Recommendations** For versions prior to 10.10.4, update to version 10.10.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.4 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption via a crafted app. This is related to the Bluetooth HCI interface implementation. **Recommendations** For versions prior to 10.10.4, update to version 10.10.4 or later to resolve the issue.