Angel Lomeli

**Name of the Vulnerable Software and Affected Versions** Airleader Master versions 6.381 and prior **Description** Airleader Master versions 6.381 and prior have a flaw allowing unrestricted file uploads to multiple webpages running with maximum privileges. This could allow an unauthenticated user to achieve remote code execution on the server. This issue affects industrial systems, particularly those managing compressed air, and poses a high risk to critical infrastructure sectors. Multiple reports indicate the potential for exploitation, with some sources describing a trivial path to remote root access. **Recommendations** Apply vendor fixes or mitigations for versions prior to and including 6.381. Restrict remote access to the controller interfaces for versions prior to and including 6.381. Segment networks to limit the potential impact of exploitation for versions prior to and including 6.381.

**Name of the Vulnerable Software and Affected Versions** Airleader Master and Easy versions prior to 6.36 **Description** The issue allows remote attackers to execute arbitrary commands via an unrestricted file upload in the Panel Designer dashboard. This can be exploited by logging into the administrator console, which has weak and easily guessable default credentials, and then uploading a JSP file via the dashboard. The `wizard/workspace.jsp` endpoint is specifically vulnerable to this type of attack, allowing the upload of malicious files. **Recommendations** For versions prior to 6.36, update to version 6.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator console and changing the default credentials to stronger, unique passwords. Additionally, restrict the ability to upload files via the Panel Designer dashboard to minimize the risk of exploitation.