010Hex

**Name of the Vulnerable Software and Affected Versions** EFM ipTIME T24000M versions prior to 14.20.0 **Description** Improper authentication exists in the Session Validation Handler component. A remote attacker can manipulate the `httpcon check session url` function to bypass authentication mechanisms. **Recommendations** Update EFM ipTIME T24000M to a version later than 14.20.0. As a temporary mitigation, restrict access to the Session Validation Handler component.

**Name of the Vulnerable Software and Affected Versions** EFM ipTIME T16000M version 14.20.2 **Description** Improper authentication occurs within the Session Validation Handler component due to a weakness in the `httpcon check session url()` function. This flaw allows remote exploitation to bypass authentication mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1-S version 2.6.0.1 **Description** A stack-based buffer overflow exists in the Web Management component. The issue occurs when the device processes input for NTP timezone settings via the `/cgi-bin/mbox-config?method=SET&section=ntp timezone` endpoint. Specifically, manipulating the `timestr` or `ntp client enabled` arguments can trigger the `sub 41AD7C()` function to overwrite critical memory. This flaw allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/cgi-bin/mbox-config?method=SET&section=ntp timezone` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1-S version 2.6.0.1 **Description** A remote command injection flaw exists in the `system()` function within the `/cgi-bin/mbox-config?method=SET&section=ntp timezone` endpoint. This occurs when the `timestr` argument is manipulated, allowing an attacker to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `timestr` parameter in the `/cgi-bin/mbox-config?method=SET&section=ntp timezone` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1-S version 2.6.0.1 **Description** A stack-based buffer overflow exists in the Web Management component. This issue occurs within the `sub 44B50C()` function of the '/cgi-bin/mbox-config?method=SET&section=ptest channel' endpoint. A remote attacker can exploit this by manipulating the input to trigger the overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/mbox-config?method=SET&section=ptest channel' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1-S version 2.6.0.1 **Description** A stack-based buffer overflow exists in the SSID Configuration component. This issue occurs when the `ssid` argument is manipulated within the `sub 44B438()` function of the '/cgi-bin/mbox-config?method=SET&section=ptest ssid' endpoint. A remote attacker can exploit this flaw to cause a system crash or potentially execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `ssid` parameter in the '/cgi-bin/mbox-config?method=SET&section=ptest ssid' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** EFM ipTIME A3004T version 14.19.0 **Description** An issue exists in the Session Validation component where the `httpcon check session url()` function allows improper authentication through manipulation. This flaw enables remote exploitation. **Recommendations** As a temporary workaround, consider restricting access to the `httpcon check session url()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.