Daniel Wong

**Name of the Vulnerable Software and Affected Versions** Mediatrix 4102 versions prior to 48.5.2718 **Description** The issue allows local attackers to gain root access via the UART port. **Recommendations** For versions prior to 48.5.2718, update to version 48.5.2718 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Nokia FastMile 5G Receiver 5G14-B version 1.2104.00.0281 **Description** An issue was discovered in the Bluetooth pairing mechanism of the Nokia ODU, which uses outdated pairing mechanisms. This allows an attacker to passively intercept a pairing handshake and, after offline cracking, retrieve the PIN and long-term key (LTK). **Recommendations** For Nokia FastMile 5G Receiver 5G14-B version 1.2104.00.0281, consider disabling Bluetooth until a patch or update is available to address the outdated pairing mechanisms. Restrict access to the Bluetooth functionality to minimize the risk of exploitation. Avoid using the device's Bluetooth feature for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Airties Smart Wi-Fi versions prior to 2020-08-04 **Description** The issue allows attackers to change the main/guest SSID and the PSK to arbitrary values and map the LAN due to Insecure Direct Object Reference. **Recommendations** For versions prior to 2020-08-04, update to a version released after 2020-08-04 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CMG Suite versions 8.4 SP2 and earlier **Description** The issue is related to SQL injection vulnerabilities due to insufficient input validation for the login interface. This could allow an unauthenticated attacker to conduct an SQL injection attack, potentially extracting sensitive information from the database and executing arbitrary scripts. **Recommendations** For CMG Suite versions 8.4 SP2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMG Suite versions 8.4 SP2 and earlier **Description** The issue is related to SQL injection vulnerabilities due to insufficient input validation for the `changepwd` interface. This could allow an unauthenticated attacker to conduct an SQL injection attack, potentially extracting sensitive information from the database and executing arbitrary scripts. **Recommendations** For CMG Suite versions 8.4 SP2 and earlier, update to a version that addresses the SQL injection vulnerabilities in the `changepwd` interface to prevent exploitation.