Chris Bellows

An issue was discovered where the bootrom function responsible for validating the Flash Product Header directly uses a user-controllable size value (`Length of Flash Config Section`) to control a read from the QSPI device into a fixed sized buffer, resulting in a buffer overflow and execution of arbitrary code.

An issue was discovered where the Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Because the encryption engine for on-the-fly decryption uses AES in CTR mode without authentication, an attacker-modified Nonce can result in execution of arbitrary code.

An issue was discovered in Plixer Scrutinizer that exposes debug logs to unauthenticated users at the "/debug/" URL path. With knowledge of valid IP addresses and source types, an unauthenticated attacker can download debug logs containing application-related information.

An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint, specifically in the `csvExportReport` endpoint action `generateCSV`, which is vulnerable to SQL injection through the `sorting` parameter. This allows an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.

An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint. The `csvExportReport` endpoint action `generateCSV` does not require authentication, allowing an unauthenticated user to export a report and access the results.

The administrator application on ASUS GT-AC2900 and Lyra Mini devices allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This issue relates to the `handle request` function in `router/httpd/httpd.c` and `auth check` in `web hook.o`. An attacker-supplied value of `0` matches the device's default value of `0` in some situations. There have been attempts to exploit this issue, with 379,868 attempts reported as failed due to a tiny error.

The issue is related to insufficient input validation for a specific command in the implementation of a CLI command, which could allow an authenticated, local attacker to overwrite files in the flash memory of the device. An attacker could exploit this by issuing a command with crafted arguments, potentially allowing them to overwrite or create files with data already present in other files hosted on the affected device.