C0Ss4Ck

NVIDIA DOCA contains an issue in the collectx-clxapidev Debian package that may allow a low-privileged actor to escalate privileges. A successful exploit of this issue could lead to privilege escalation.

A Remote Command Injection issue exists in the mainfunction.cgi script of the DrayTek Vigor web interface due to inadequate data sanitization at the management level. This could allow a remote attacker to execute arbitrary code by sending a crafted HTTP message with a malformed QUERY STRING to the mainfunction.cgi endpoint.

The issue is related to a Format String vulnerability in the mainfunction.cgi file of the DrayTek Vigor web interface. This vulnerability can be exploited by a remote attacker using a crafted HTTP message with a malformed QUERY STRING, potentially allowing the execution of arbitrary code.

Name of the Vulnerable Software and Affected Versions: D-Link DSR-250 version 3.14 D-Link DSR-1000N version 2.11B201 Description: The UPnP service in the affected devices contains a command injection issue, which can lead to remote command execution. Recommendations: For D-Link DSR-250 version 3.14, consider disabling the UPnP service until a patch is available. For D-Link DSR-1000N version 2.11B201, consider disabling the UPnP service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.