Catalpa

**Name of the Vulnerable Software and Affected Versions** HBS 3 Hybrid Backup Sync versions prior to 25.1.4.952 **Description** A buffer overflow issue has been reported, which could allow remote attackers to modify memory or crash processes. **Recommendations** For versions prior to 25.1.4.952, update to version 25.1.4.952 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SonicOS (affected versions not specified) **Description** A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SonicOS (affected versions not specified) **Description** A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SonicOS (affected versions not specified) **Description** A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. This issue enables unauthorized access to sensitive data by traversing the file system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 5.0.1.2376 build 20230421 QTS versions prior to 4.5.4.2374 build 20230416 QuTS hero versions prior to h5.0.1.2376 build 20230421 QuTS hero versions prior to h4.5.4.2374 build 20230417 QuTScloud versions prior to c5.0.1.2374 **Description** An OS command injection issue has been reported to affect several QNAP operating system versions. If exploited, the issue could allow users to execute commands via a network. This could potentially allow a remote attacker to execute arbitrary commands. **Recommendations** For QTS versions prior to 5.0.1.2376 build 20230421, update to QTS 5.0.1.2376 build 20230421 or later. For QTS versions prior to 4.5.4.2374 build 20230416, update to QTS 4.5.4.2374 build 20230416 or later. For QuTS hero versions prior to h5.0.1.2376 build 20230421, update to QuTS hero h5.0.1.2376 build 20230421 or later. For QuTS hero versions prior to h4.5.4.2374 build 20230417, update to QuTS hero h4.5.4.2374 build 20230417 or later. For QuTScloud versions prior to c5.0.1.2374, update to QuTScloud c5.0.1.2374 or later.

**Name of the Vulnerable Software and Affected Versions** Cisco SPA112 versions (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Cisco has stated that they will not release firmware updates to address this vulnerability since the 2-Port Phone Adapters are already end-of-life. As a workaround, Cisco recommends transitioning to the Cisco ATA 190 series analog telephone adapter.