Deral Heiland

Name of the Vulnerable Software and Affected Versions: Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier Description: The issue concerns insufficiently protected credentials in LDAP, allowing an attacker to reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker can force the target device to authenticate to the attacker-controlled LDAP service, enabling the capture of the plaintext password of the configured LDAP service. Recommendations: For version GCQ-Y3 or earlier, consider disabling the LDAP service until a patch is available to prevent reconfiguration by an attacker. Restrict access to the device's configuration to minimize the risk of exploitation. Avoid using the LDAP password on the target device until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Genie Company Aladdin Connect garage door opener is vulnerable to XSS via a broadcast SSID name containing malicious code with client-side JavaScript and/or HTML when placed into configuration mode. This allows an attacker to inject malicious code into the user's web browser through the "Garage Door Control Module Setup" page.

The issue concerns the storage of users' product account authentication data in clear text within the application. This allows an attacker with access to the Android device to potentially retrieve users' clear text authentication credentials.

Unauthenticated access is permitted to the web interface page "Garage Door Control Module Setup" of The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM), allowing modification of the Garage door's SSID settings.

The issue allows for format string attacks via application messaging when in superuser mode, potentially enabling an attacker to read memory and access sensitive information.

The issue concerns a lack of mutual authentication with the gateway server host. This could allow an attacker to perform a man-in-the-middle attack, modifying parameters to cause the network connection to fail.

The issue concerns the storage of network credentials and Protected Health Information (PHI) in unencrypted form, specifically applicable to Spectrum IQ pumps using auto programming. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.

The issue allows an attacker to compromise the affected BlueCats network implementation by accessing a clear text file that stores the `username` and `password`. This file remains on the device until the user logs out or the session times out after 30 days of inactivity. To exploit this, an attacker would first need to gain physical control of the Android device or compromise it with a malicious app.

The issue allows modification of getgps data without authentication by utilizing the `cmd:setothergps` parameter. This can be exploited to alter the GPS data of a lost device.

The issue allows unauthenticated Bluetooth pairing, enabling unauthenticated connected applications to write data to the `device name` attribute.

The issue concerns the storage of account passwords in cleartext within the cache.db file of the app, which is used for authentication to the cloud API.

The issue concerns the Zizai Tech Nut mobile app making requests via HTTP instead of HTTPS, which includes the user's authenticated session token in the URL. This allows an attacker to capture these requests and reuse the session token, potentially gaining full access to the user's account.

The issue concerns the session management in iTrack Easy. Specifically, session cookies are not utilized to maintain valid sessions. Instead, the user's password is transmitted as a POST parameter over HTTPS on every request, using a base64 encoded `passwd` field. This means that sessions can only be terminated when the user changes the associated password.

The issue concerns the storage of account passwords in the iTrack Easy mobile application. Specifically, the application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. Since base64 encoding is considered equivalent to cleartext, this poses a significant security risk.

The issue concerns the iTrack device, where the tracking ID number, also referred to as "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address.

The issue allows a captured MAC or device ID of an iTrack Easy to be registered under multiple user accounts, enabling access to getgps GPS data. This can permit unauthenticated parties to track the device.

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.