Bhadresh Patel

**Name of the Vulnerable Software and Affected Versions** ManageEngine ADSelfService Plus versions prior to build 6003 **Description** An elevation of privilege issue exists because the software does not properly enforce user privileges associated with a Certificate dialog. This could allow an unauthenticated attacker to escalate privileges on a Windows host without requiring any privilege on the target system. The attacker can exploit this by triggering a security alert with a self-signed SSL certificate, then using the View Certificate option to export the certificate and open Explorer as SYSTEM, ultimately launching cmd.exe as SYSTEM. **Recommendations** For ManageEngine ADSelfService Plus versions prior to build 6003, update to build 6003 or later to resolve the issue. As a temporary workaround, consider restricting access to the self-service option on the Windows login screen to minimize the risk of exploitation. Additionally, restrict the ability to export certificates and limit access to the Explorer application to prevent an attacker from launching cmd.exe as SYSTEM.

**Name of the Vulnerable Software and Affected Versions** Sophos Cyberoam firewall devices with firmware through 10.6.4 **Description** The issue allows remote attackers to execute arbitrary client-side script on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of a request to the "LiveConnectionDetail.jsp" application. The `applicationname` and `username` GET parameters are improperly sanitized, allowing an attacker to inject arbitrary JavaScript into the page. This can be abused to perform a cross-site scripting attack on the user. A vulnerable URI is /corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp. **Recommendations** For Sophos Cyberoam firewall devices with firmware through 10.6.4, consider restricting access to the LiveConnectionDetail.jsp application until a patch is available. As a temporary workaround, avoid using the `applicationname` and `username` parameters in the affected API endpoint.

**Name of the Vulnerable Software and Affected Versions** NetCommWireless HSPA 3G10WVE wireless routers versions prior to 3G10WVE-L101-S306ETS-C01 R05 **Description** The issue allows remote attackers to bypass intended access restrictions via a direct request to the `ping.cgi` endpoint. This can potentially be combined with other issues to execute arbitrary commands. **Recommendations** For versions prior to 3G10WVE-L101-S306ETS-C01 R05, update the firmware to version 3G10WVE-L101-S306ETS-C01 R05 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ping.cgi` endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NetCommWireless HSPA 3G10WVE wireless routers versions prior to firmware 3G10WVE-L101-S306ETS-C01 R05 **Description** The issue is related to the `ping.cgi` script in the router's firmware, which lacks proper input sanitization. This allows a remote authenticated user to execute arbitrary commands by injecting shell metacharacters into the `DIA IPADDRESS` parameter. **Recommendations** For versions prior to firmware 3G10WVE-L101-S306ETS-C01 R05, update the firmware to version 3G10WVE-L101-S306ETS-C01 R05 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ping.cgi` script until the firmware can be updated. Avoid using the `DIA IPADDRESS` parameter in the `ping.cgi` script with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-816L Wireless Router versions prior to 2.06.B09 BETA **Description** The issue allows remote attackers to hijack the authentication of administrators for requests, including changing the admin password and network policy, via crafted requests to "hedwig.cgi" and "pigwidgeon.cgi" API endpoints. **Recommendations** For versions prior to 2.06.B09 BETA, update the firmware to version 2.06.B09 BETA or later to resolve the issue. As a temporary workaround, consider restricting access to the "hedwig.cgi" and "pigwidgeon.cgi" API endpoints until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Hotspot Express hotEx Billing Manager version 73 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `reply` parameter in the `/cgi-bin/hotspotlogin.cgi` API endpoint. **Recommendations** For Hotspot Express hotEx Billing Manager version 73, consider restricting access to the `/cgi-bin/hotspotlogin.cgi` endpoint until a patch is available, and avoid using the `reply` parameter in this endpoint to minimize the risk of exploitation.