Abhinav Agarwal

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

Improper verification of cryptographic signatures and improper certificate validation in the OPC UA driver (PLC4J) allow a network attacker to impersonate the OPC UA server. This enables the attacker to read, forge, or modify secure-channel traffic, including user credentials sent by the client. In versions 0.9.0 through 0.11.0, failed message-signature checks are only logged without enforcement, and server certificates are taken from unauthenticated GetEndpoints discovery responses. In versions 0.12.0 through 0.13.1, the signature check is inverted, accepting invalid signatures while rejecting valid ones, and server certificates are accepted without a trust anchor by default. Additionally, the default security policy is None across all affected versions; versions 0.12.0 and later may silently continue with a weaker security policy than configured, and version 0.13.0 prefers the weakest matching endpoint during selection.

Memory allocation with excessive size values, allocation of resources without limits, and uncontrolled recursion in the Java implementation of Apache PLC4X (PLC4J) can allow a malicious or impersonated device to exhaust the memory or stack of the client application, leading to a denial of service. In the OPC UA driver, these issues are reachable before authentication during the establishment of the secure channel and session. Technical details include: - Length-prefixed byte strings are allocated based on the size claimed on the wire before verifying the actual data received. - Generated protocol parsers pre-allocate lists based on element counts claimed on the wire, which can trigger multi-gigabyte allocations. This parser is used by all PLC4J drivers, with the OPC UA driver as a verified pre-authentication path. - The OPC UA driver fails to enforce negotiated maximum chunk counts and message sizes when accumulating message chunks. - The OPC UA driver pre-allocates collections using element counts received from the server. - Recursive protocol types are parsed without a nesting-depth limit.

On ARM64 and RISC-V platforms, the SM2 curve utilizes a scalar multiplication implementation that is not constant-time. Because conditional branches and table lookups are determined by the bits of the secret scalar, the execution time and cache-access patterns depend on the long-term private key during decryption or the per-signature nonce during signature generation. This creates a timing and cache side-channel that allows an attacker to learn information about the secret scalar.

UASC server transport handlers do not release retained partial message chunks upon channel disconnection. This allows a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, which may lead to server termination.

The Call service dispatches the original mixed batch to address-space handlers after calculating authorization. This allows an anonymous or low-privileged client to execute a denied method by batching it with an allowed method.

OPC UA server diagnostics nodes fail to enforce access authorization. This allows an anonymous client to enable diagnostics via a None/None endpoint without a certificate. Additionally, a client using a trusted application certificate over SignAndEncrypt can read security diagnostics for other active sessions, which exposes usernames, login history, authentication mechanisms, security modes, policies, and public client certificates.

The `OpcUaServerConfig.copy()` function fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration using `copy()`, sessions are not assigned role IDs. Consequently, the default access controller bypasses role-permission checks. This allows anonymous clients, in environments where anonymous sessions are permitted, to read role-permission metadata, invoke protected methods, or delete protected nodes.

Username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle—a side-channel attack that reveals information about the plaintext by observing error responses—to recover the victim's password and authenticate with the recovered credentials.

Monitored-item quota accounting is not exception-safe, meaning that if item creation fails due to an unchecked error, the server-global reservation is not restored. An unauthenticated remote client can trigger a `StackOverflowError` during decoding by using deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter. This allows the attacker to exhaust the finite global monitored-item quota, preventing all clients from creating new monitored items until the server is restarted. Existing monitored items and other server functions are not affected.

A missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In the function `hostapd process ml assoc req()`, the `link id` field can be parsed as value 15, while the `links[]` storage only contains valid entries for IDs 0 through 14. This results in an out-of-bounds write and small memory corruption during association processing before the 4-way handshake, leading to a denial of service through process termination. The issue specifically affects systems built with `CONFIG IEEE80211BE` enabled.

A remote peer can cause unbounded memory allocation leading to a Denial of Service and abnormal termination of an application acting as a QUIC client or server. This occurs when a malicious peer floods the local QUIC stack with PATH CHALLENGE frames. The stack allocates a PATH RESPONSE frame for every received PATH CHALLENGE, but these frames are only freed once the remote peer acknowledges their reception, which a malicious actor will not do, resulting in heap memory exhaustion.