Atdog

A heap-based buffer overflow occurs in Windows Hyper-V, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a condition where a program writes more data to a heap memory buffer than it can hold, potentially leading to memory corruption.

A format string vulnerability in the IPSec VPN feature could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer. However, such an attack would require detailed knowledge of an affected device’s memory layout and configuration. The vulnerability is related to the use of uncontrolled format strings.

A format string vulnerability could allow an authenticated IPSec VPN user to cause DoS conditions against the `deviceid` daemon by sending a crafted hostname to an affected device if it has the `Device Insight` feature enabled. This issue is related to the use of uncontrolled format strings in the `Device Insight` feature of the affected devices.

The issue is related to a post-authentication command injection vulnerability in the file upload binary, allowing an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP. This can be achieved by exploiting the vulnerability in the file upload process, which does not properly neutralize special elements used in the command.

A null pointer dereference issue in the Anti-Malware feature of Zyxel ATP and USG FLEX series firmware could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host. This issue is related to pointer dereference errors and can be exploited by a remote attacker to cause a denial of service.

The issue is related to an integer overflow vulnerability in the QuickSec IPSec toolkit used in the VPN feature of various Zyxel devices. This vulnerability could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.

A buffer overflow vulnerability in the notification function could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device. The vulnerability is related to a lack of size checking for input data, which can be exploited by a remote attacker.

A format string vulnerability in the Zyxel firmware could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled. The vulnerability is related to the use of uncontrolled format strings, which may allow a remote attacker to execute arbitrary commands.

The issue is related to a command injection vulnerability in the configuration parser of the affected Zyxel devices. This vulnerability can be exploited by an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled. The exploitation occurs during an attempted `ip addr` command, and the order of operations is important for successful exploitation. It is estimated that out of approximately 7,600 devices using vulnerable firmware, around 607 were using the vulnerable configuration.

The configuration parser fails to sanitize user-controlled input in the affected Zyxel devices. An unauthenticated, LAN-based attacker could leverage this issue to inject operating system (OS) commands into the device configuration data on an affected device when the cloud management mode is enabled.

The issue is related to a command injection vulnerability in the CLI command of Zyxel's firmware, which could allow an authenticated attacker with administrator privileges to execute OS commands. This is due to the lack of proper sanitization of special elements used in the OS command. The exploitation of this issue may enable a remote attacker to execute arbitrary commands.

Name of the Vulnerable Software and Affected Versions: NETGEAR R7800 version 1.0.2.76 Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of the `vendor specific` DHCP opcode. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root. Recommendations: For NETGEAR R7800 version 1.0.2.76, consider applying a patch or update that addresses the improper validation of user-supplied strings in the handling of the `vendor specific` DHCP opcode. As a temporary workaround, restrict access to the DHCP service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

The issue is related to reflected XSS, which affects certain NETGEAR devices.