Alibek Baxtiyorov

**Name of the Vulnerable Software and Affected Versions** ESPHome versions prior to 2026.7.0-dev **Description** An operator-precedence bug exists in the `cv.url()` validator within `esphome/config validation.py`. Due to the `and` operator binding tighter than `or`, any `file:` URI passes validation regardless of the network location. This validator controls the `url:` field of the `external components` YAML directive's git source schema, which is subsequently passed to `git clone`. An attacker can use a crafted `external components` block with a `url` pointing to a local path, such as `file:///attacker/repo`, to clone an attacker-controlled local directory. This directory is then added to the Python import machinery via the ESPHome component loader, allowing the execution of arbitrary Python code when the YAML configuration is processed through commands like `esphome config` or `esphome run`. **Recommendations** Update ESPHome to a version later than 2026.7.0-dev.

**Name of the Vulnerable Software and Affected Versions** ESPHome versions prior to 2026.7.0-dev **Description** The `web server` component discloses plaintext passwords. In the `WebServer::text json ()` function, text entities configured with `mode: password` have their JSON `state` field masked, but the raw password is written into the JSON `value` field through `set json icon state value()` and `set json value()`. Since the web server listens on port 80 without authentication by default, an attacker on the local network can retrieve sensitive information, such as WiFi credentials or API tokens, via the `GET /text/<entity id>` endpoint or the `/events` EventSource stream. **Recommendations** Update to a version later than 2026.7.0-dev. As a temporary mitigation, restrict access to the `web server` component or avoid using the `mode: password` configuration for text entities.

**Name of the Vulnerable Software and Affected Versions** dr libs dr wav.h (affected versions not specified) **Description** An integer overflow exists in W64 CUE chunk metadata parsing. In the `drwav metadata process chunk()` function, a stage-1 capacity estimate truncates the 64-bit W64 chunk `sizeInBytes` to `size t` before dividing by `DRWAV CUE POINT BYTES`. On 32-bit builds, this truncation leads to an incorrect computation of the pre-allocated extra metadata capacity. Subsequently, the `drwav read cue to metadata obj()` function calculates the actual cue point count and allocation size using the attacker-controlled `cuePointCount` field without verifying it against the initial capacity estimate. Because the bounds enforcement in `drwav metadata get memory()` relies on a `DRWAV ASSERT` that is disabled in release builds, a specially crafted W64 WAV file can trigger a heap buffer overflow in 32-bit applications parsing untrusted WAV metadata. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IoTSharp (affected versions not specified) **Description** The `BlobStorageController.cs` component lacks the `[Authorize]` attribute and does not have a global authorization `FallbackPolicy` configured in `Startup.cs`. This allows unauthenticated remote attackers to access the 'Upload', 'Download', 'List', 'Modify', and 'Delete' endpoints. Furthermore, the `path` and `filename` parameters passed to these endpoints are used without sanitization in the ` blob.WriteFileAsync()` function. This leads to path traversal, enabling attackers to read, write, modify, and delete arbitrary files outside the intended blob storage directory. If web-accessible paths are targeted, this can be leveraged to achieve remote code execution through the upload of a webshell. **Recommendations** Apply the `[Authorize]` attribute to the `BlobStorageController.cs` or configure a global authorization `FallbackPolicy` in `Startup.cs` to prevent unauthenticated access. Sanitize the `path` and `filename` parameters used in the ` blob.WriteFileAsync()` function to prevent path traversal. Restrict access to the `BlobStorageController.cs` endpoints until these fixes are implemented.

**Name of the Vulnerable Software and Affected Versions** FreeModbus LINUXTCP port (affected versions not specified) **Description** The LINUXTCP port of FreeModbus contains an off-by-one bounds check within the `xMBPortTCPPool()` function located in `demo/LINUXTCP/port/porttcp.c`. The issue occurs because the check `if (usTCPFrameBytesLeft > MB TCP BUF SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte `MB TCP BUF SIZE` limit. An MBAP (Modbus Application Protocol) frame with a Length field of 264 results in `usTCPFrameBytesLeft` being 263, which bypasses the check. Consequently, the `recv()` function writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer `aucTCPBuf`, causing a 7-byte overflow into the adjacent static variable `usTCPBufPos`. This can be triggered by a single crafted, unauthenticated Modbus TCP packet. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WLED (affected versions not specified) **Description** The software contains two security flaws. First, the 'GET /json/cfg' endpoint calls the `serveJson()` function without verifying the settings-PIN, allowing any unauthenticated client on the network to view general configuration details, including network, hardware, and LED setup. Second, the settings-PIN unlock state is managed by a single global boolean variable `correctPIN` rather than per-session state. Consequently, if any client provides the correct 4-digit PIN via the 'POST /json' endpoint, the `correctPIN` variable is set to true for all users. This grants all subsequent unauthenticated clients full write access to the configuration, enabling actions such as OTA firmware updates, WiFi reconfiguration, and factory resets until the device is rebooted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Domoticz (affected versions not specified) **Description** The `MochadTCP::MatchLine()` function in the `hardware/MochadTCP.cpp` file fails to perform length checks when copying data from the `m mochadbuffer` (up to 1028 bytes) into a fixed 50-byte stack buffer named `tempRFSECbuf` using `strcpy()`. This occurs across three code branches for DS10A, KR10A, and MS10A device types. A local network attacker can send a crafted packet to the Mochad TCP bridge on port 1099, which requires no authentication, to overflow `tempRFSECbuf` and corrupt the worker thread stack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tinyobjloader-c (affected versions not specified) **Description** The `tinyobj parse and index mtl file()` function in `tinyobj loader c.h` reads lines from a .mtl material file into a fixed 4096-byte stack buffer `linebuf` using `memcpy(linebuf, p, p len)`. The operation is guarded by `assert(p len < 4095)`, but since `assert()` is disabled in release builds (compiled with -DNDEBUG), a crafted .mtl file with a line exceeding 4096 bytes can cause a stack overflow. This allows the `linebuf` to overflow into the adjacent `namebuf` variable and other stack memory, potentially corrupting the stack of applications loading malicious 3D model or material files. This same pattern exists in another function within the same file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** microtar (affected versions not specified) **Description** The `mtar write file header()` and `mtar write dir header()` functions in `src/microtar.c` contain a stack buffer overflow. This occurs because a caller-supplied entry name is copied into the 100-byte `name` field of a stack-allocated `mtar header t` using `strcpy(h.name, name)` without verifying that the length of the `name` variable is less than 100 characters. Applications that use these functions to archive filenames influenced by external users or attackers longer than 99 characters can trigger this overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenPLC Runtime version 3 **Description** The `compile program()` function in `webserver/openplc.py` fails to validate the `file path` variable when parsing `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files. This allows an attacker to use path traversal sequences to write arbitrary content to any filesystem path outside the intended `./core` directory, leading to remote code execution through mechanisms such as cron jobs or SSH authorized keys. The software also contains hardcoded default credentials (openplc:openplc), which facilitates exploitation. **Recommendations** Update OpenPLC Runtime version 3 to a version where the `compile program()` function properly invokes the `validate file path()` function to ensure the `file path` remains within the intended directory. Change the default credentials from openplc:openplc to unique, strong passwords.

**Name of the Vulnerable Software and Affected Versions** Node-RED (affected versions not specified) **Description** The local-filesystem library storage module contains a path traversal flaw in the `getLibraryEntry()` and `saveLibraryEntry()` functions. This issue occurs because the user-supplied path parameter is joined directly into the filesystem path via `fspath.join(libDir, type, path)` without sanitization, containment checks, or path normalization. The flaw is reachable via the GET and POST endpoints `/library/:lib/:type/*path`. An authenticated user can use `../` sequences to read arbitrary files outside the library directory. Users with write access can write arbitrary files, which may lead to remote code execution through cron injection or by modifying SSH authorized keys. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Stirling-PDF (affected versions not specified) **Description** The `POST /api/v1/convert/url/pdf` endpoint in `ConvertWebsiteToPDF.java` lacks Server-Side Request Forgery (SSRF) protections. While the endpoint verifies that the initial URL resolves to a public IP, it fetches the HTML and passes it unsanitized to a WeasyPrint subprocess. This allows an attacker to use embedded resource references, such as `<img>` tags, to force the server to retrieve internal network resources or cloud metadata endpoints and include their contents in the resulting PDF. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Memos (affected versions not specified) **Description** Insufficient validation of webhook URLs occurs in the `isReservedIP()` function located in `internal/webhook/validate.go`. The function checks candidate IPs against a reserved CIDR list but omits the 0.0.0.0/8 range and fails to call `ip.IsUnspecified()`. Since Linux redirects connections to 0.0.0.0 to the loopback interface (127.0.0.1), an attacker can register a webhook URL such as 'http://0.0.0.0:PORT/' to bypass reserved-IP checks. This allows the server to make outbound HTTP requests to its own loopback interface, potentially exposing internal-only services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Memos (affected versions not specified) **Description** The webhook dispatch function `safeDialContext()` (internal/webhook/webhook.go) resolves the target hostname using `net.DefaultResolver.LookupHost` and validates the resulting IPs against reserved ranges. However, it subsequently calls `net.JoinHostPort(host, port)` using the original hostname instead of the validated IP address. Since `net.Dialer.DialContext()` performs its own DNS resolution, an attacker controlling the DNS for the webhook's hostname can employ a DNS-rebinding technique. By using a short Time-to-Live (TTL), the attacker can provide a public, allowed IP during the validation phase and a different internal IP during the actual connection phase, bypassing Server-Side Request Forgery (SSRF) protections. DNS-rebinding is a technique used to bypass security controls by changing the DNS record between the time of validation and the time of use. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenBK7231T (affected versions not specified) **Description** The '/cfg wifi set' endpoint in 'src/httpserver/http fns.c' allows configuration changes through a GET request without requiring a Cross-Site Request Forgery (CSRF) token. CSRF is a type of attack that tricks a victim into submitting a malicious request. If the `web admin password enabled` parameter is missing from the request, the system clears the web admin password, setting it to an empty string. This allows an attacker to use a one-click payload to hijack the WiFi configuration and disable password protection if an authenticated administrator visits a malicious link. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenBK7231T (affected versions not specified) **Description** The software fails to sanitize channel labels received via the MQTT SetChannelLabel command in the `CHANNEL SetLabel()` function (src/cmnds/cmd channels.c). These labels are stored using `strdup()` and subsequently returned unsanitized by `CHANNEL GetLabel()`. The labels are then rendered via `hprintf255()` at over 15 locations in src/httpserver/http fns.c without HTML encoding. An attacker with access to the MQTT broker can inject a `<script>` payload into a channel label, which executes when a user views the device web panel. This is a stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the target server and served to other users. **Recommendations** As a temporary workaround, restrict access to the MQTT broker to prevent unauthorized users from sending the SetChannelLabel command. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OpenBK7231T's http fn ota exec() (src/httpserver/http fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.

**Name of the Vulnerable Software and Affected Versions** Magistrala (formerly Mainflux) (affected versions not specified) **Description** The message-readers API reads a `format` value from the HTTP query string in `readers/api/http/transport.go` without validation. This value is interpolated directly into raw SQL queries using `fmt.Sprintf()` within the PostgreSQL reader (`readers/postgres/messages.go`) and the TimescaleDB reader (`readers/timescale/messages.go`). This flaw allows an authenticated user with permissions to query channel messages to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution by the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rust-iot-platform (affected versions not specified) **Description** The `AuthToken` request-guard implementation in `api/src/main.rs` fails to validate the value of the `Authorization` HTTP header against a session, token store, or signature. It only verifies that the header is present. Consequently, any request containing a non-empty `Authorization` header can bypass the guard and gain access to all protected endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rust-iot-platform (affected versions not specified) **Description** An unauthenticated attacker can achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule. The endpoint 'POST /calc-rule/create' lacks the AuthToken request guard, allowing access without authentication to create a rule containing an arbitrary `script` field. This stored script is subsequently executed via the `quick js::Context::eval()` function without sandboxing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'POST /calc-rule/create' endpoint to minimize the risk of exploitation.