Aarón Flecha

**Name of the Vulnerable Software and Affected Versions** SaTECH BCU version 2.1.3 **Description** The issue allows XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users, causing them to interpret the code stored on another malicious website owned by the attacker. **Recommendations** For SaTECH BCU version 2.1.3, consider restricting access to the web server to minimize the risk of exploitation. As a temporary workaround, avoid using the web application until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** saTECH BCU firmware version 2.1.3 **Description** A privilege escalation issue exists in the saTECH BCU firmware, allowing an attacker with access to the device's Command Line Interface (CLI) to bypass restrictions and elevate privileges to a superuser using the `nice` command. This issue is considered critical and requires immediate attention. **Recommendations** For saTECH BCU firmware version 2.1.3, apply the necessary patch to fix the privilege escalation vulnerability. As a temporary workaround, consider restricting access to the CLI and limiting the use of the `nice` command to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** An attacker with access to the network where the vulnerable device is located could capture traffic and obtain cookies from the user, allowing them to steal a user's active session and make changes to the device via the web, depending on the privileges obtained by the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SaTECH BCU version 2.1.3 **Description** The issue allows an authenticated attacker to access information about user credentials within the web, specifically through an .xml file. To exploit this, the attacker must know the path, and this can be done regardless of the user's privileges on the website. **Recommendations** For SaTECH BCU version 2.1.3, consider restricting access to the .xml file that contains user credentials until a patch is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SaTECH BCU version 2.1.3 **Description** The issue concerns the use of the HTTP protocol for web browsing, which exchanges information in unencrypted text. This poses a problem as sensitive data, such as credentials, are exchanged and could be obtained by an attacker, allowing them to log in legitimately. **Recommendations** For SaTECH BCU version 2.1.3, consider disabling the use of HTTP protocol for sensitive transactions until a secure alternative, such as HTTPS, is implemented. Restrict access to sensitive data and credentials to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SaTECH BCU version 2.1.3 **Description** The issue concerns weak password encryption in the firmware. This weakness allows an attacker with access to the device's system or website to obtain credentials due to insufficiently strong encryption methods. **Recommendations** For version 2.1.3, consider changing passwords and restricting access to the device's system or website until a fix is available. As a temporary workaround, restrict access to sensitive areas of the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** saTECH BCU firmware version 2.1.3 **Description** The issue is related to a cross-site request forgery (CSRF) vulnerability in the web application, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions. **Recommendations** For saTECH BCU firmware version 2.1.3, consider implementing additional security measures to prevent CSRF attacks, such as validating requests to ensure they come from an authentic source, until a patch is available. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SaTECH BCU version 2.1.3 **Description** The issue allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser, which is a reflected XSS attack. **Recommendations** For SaTECH BCU version 2.1.3, consider updating the firmware to a version that addresses this issue, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to sensitive features that may be exploited through the reflected XSS attack.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: The issue allows an attacker with access to the web service to bypass authentication mechanisms on the login page, enabling them to use all functionalities implemented at the web level that allow interacting with the device, potentially leading to a denial of service (DoS) attack. Recommendations: For version 1.0.4, consider restricting access to the web service until a patch is available, and ensure that authentication mechanisms are properly secured to prevent bypassing. As a temporary workaround, limit the use of functionalities implemented at the web level to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: An attacker with access to the network where CIRCUTOR Q-SMT is located could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. Recommendations: For CIRCUTOR Q-SMT version 1.0.4, consider implementing token expiration to restrict access to the web application. As a temporary workaround, restrict access to the network where CIRCUTOR Q-SMT is located to minimize the risk of token theft. Additionally, monitor network activity and locally stored web information for potential security breaches. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR TCP2RS+ version 1.3b Description: The issue allows an attacker to modify any configuration value without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use, even if the device has the user/password authentication option enabled. This equipment is at the end of its useful life cycle. Recommendations: For version 1.3b, as a temporary workaround, consider restricting access to the UDP protocol and port 2000 until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: An attacker with access to the network where the CIRCUTOR Q-SMT is located could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol, preventing a secure communication channel from being established. Recommendations: For version 1.0.4, consider disabling the use of the HTTP protocol until a patch is available, and restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: An attacker with no knowledge of the current users in the web application could build a dictionary of potential users and check the server responses, as it indicates whether or not the user is present. Recommendations: For CIRCUTOR Q-SMT version 1.0.4, consider restricting access to the user enumeration functionality until a patch is available. As a temporary workaround, limit the number of login attempts to prevent brute-force attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR TCP2RS+ version 1.3b Description: The issue allows an attacker to modify any configuration value without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This is possible even if the device has the user/password authentication option enabled. The equipment is at the end of its useful life cycle. Recommendations: For version 1.3b, consider restricting access to port 2000 to minimize the risk of exploitation, and avoid using the UDP protocol for configuration changes until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Digi ConnectPort X2D (affected versions not specified) **Description** The issue is related to errors in access control, allowing a remote attacker to execute arbitrary code by uploading specially crafted python files. This is due to the lack of device access protections and device permissions when using the web application, which could lead to malicious actions being executed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.