Chuya Hayakawa

**Name of the Vulnerable Software and Affected Versions** Archer BE450 v1 Archer BE7200 v1 **Description** An authenticated command injection allows an administrator to execute arbitrary system commands through the web management interface. By using the browser developer console, a crafted input can be supplied that is passed to backend system commands without adequate sanitization. Successful exploitation enables the execution of commands with elevated privileges, potentially allowing the attacker to start unauthorized services, modify system configuration, or fully compromise the router operating environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NEC Platforms, Ltd. Aterm Series (affected versions not specified) **Description** An OS Command Injection issue exists in NEC Platforms, Ltd. Aterm Series. This allows a malicious actor to execute arbitrary OS commands through the network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NEC Platforms, Ltd. Aterm Series (affected versions not specified) **Description** A path traversal flaw exists in NEC Platforms, Ltd. Aterm Series, potentially allowing an attacker to overwrite any file through network access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NEC Platforms, Ltd. Aterm Series (affected versions not specified) **Description** An OS Command Injection issue exists in NEC Platforms, Ltd. Aterm Series. This allows a malicious actor to execute arbitrary OS commands through the network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NEC Platforms, Ltd. Aterm Series (affected versions not specified) **Description** A hidden functionality exists in NEC Platforms, Ltd. Aterm Series that allows an attacker to enable telnet access via the network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MR-GM5L-S1 MR-GM5A-L1 **Description** An authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MR-GM5L-S1 MR-GM5A-L1 **Description** A code injection issue exists in MR-GM5L-S1 and MR-GM5A-L1. Successful exploitation of this issue may allow an attacker with administrative privileges to execute arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MR-GM5L-S1 MR-GM5A-L1 **Description** A hard-coded credentials issue exists in the software, potentially allowing an attacker to gain administrative access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer MR600 version v5 **Description** A command injection issue exists in the admin interface component. Authenticated attackers can execute system commands with a limited character length through crafted input in the browser developer console, potentially causing service disruption or full system compromise. The vulnerability is present when interacting with the admin interface. The vulnerable component allows execution of commands via the browser console. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenBlocks versions prior to 5.0.8 **Description** An authentication bypass issue exists that may allow an attacker to bypass administrator authentication and change the password. **Recommendations** Update to version 5.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Ruijie Networks AP180 series versions (affected versions not specified) **Description** The RG-AP180, an indoor wall plate wireless AP, contains an OS command injection issue. An attacker who gains access to the CLI service can execute arbitrary OS commands on the device. The vulnerability allows for the execution of commands through the CLI service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WN-7D36QR WN-7D36QR/UE **Description** A hidden functionality issue exists that may allow a remote authenticated attacker to enable SSH access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WN-7D36QR WN-7D36QR/UE **Description** An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A remote authenticated attacker may be able to execute arbitrary OS commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iND Co.,Ltd products (affected versions not specified) **Description** Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information issue. Exploitation may lead to the disclosure of configuration information, such as admin passwords. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iND Co.,Ltd products (affected versions not specified) **Description** Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. Exploitation may allow an arbitrary OS command to be executed and sensitive information to be obtained. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TB-eye network recorders and AHD recorders (affected versions not specified) Description: A buffer overflow issue exists in the affected devices. The CGI process may terminate abnormally when processing a specially crafted request. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TB-eye network recorders (affected versions not specified) AHD recorders (affected versions not specified) Description: A problem of injection of system operating system commands exists in the mentioned devices. If this issue is exploited, an attacker who logs in to the device could execute an arbitrary system command. Recommendations: For TB-eye network recorders, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For AHD recorders, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH (affected versions not specified) Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the telnet function. A remote unauthenticated attacker can send a specially crafted request to execute an arbitrary OS command. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH (affected versions not specified) Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the miniigd SOAP service. A remote unauthenticated attacker can send a specially crafted request to execute an arbitrary OS command. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: I-O DATA HDL-T Series versions 1.21 and earlier Description: The issue is related to a lack of authentication for critical functions in the firmware. This could allow a remote unauthenticated attacker to modify the product's configuration settings. Recommendations: For I-O DATA HDL-T Series versions 1.21 and earlier, consider restricting access to the device until a patch is available. As a temporary workaround, limit the exposure of the device to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.