Chris Watts

**Name of the Vulnerable Software and Affected Versions** Casa Systems NTC-221 versions 2.0.99.0 and before **Description** The issue allows a remote attacker to execute arbitrary code via a crafted payload to the "/www/cgi-bin/nas.cgi" component. This enables the attacker to potentially gain control over the system. **Recommendations** For Casa Systems NTC-221 versions 2.0.99.0 and before, consider restricting access to the "/www/cgi-bin/nas.cgi" component until a patch is available. As a temporary workaround, avoid using the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Casa Systems NL1901ACV version R6B032 **Description** An issue allows a remote attacker to execute arbitrary code via the `userName` parameter of the `add` function. **Recommendations** For Casa Systems NL1901ACV version R6B032, avoid using the `userName` parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco IOS XR Software (affected versions not specified) **Description** A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary commands within the GRUB environment that allow sensitive files to be viewed. An attacker could exploit this vulnerability by being connected to the console port of the Cisco IOS XR device when the device is power-cycled. A successful exploit could allow the attacker to view sensitive files that could be used to conduct additional attacks against the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. However, Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.