Edwin Gozeling

**Name of the Vulnerable Software and Affected Versions** Siime Eye version 14.1.00000001.3.330.0.0.3.14 **Description** An issue was discovered in Siime Eye where the password for the root user is hashed using an old and deprecated hashing technique. Because of this deprecated hashing, the success probability of an attacker in an offline cracking attack is greatly increased. **Recommendations** For Siime Eye version 14.1.00000001.3.330.0.0.3.14, update to the latest firmware to mitigate the risk of exploitation. As a temporary workaround, consider restricting network access to the device until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Siime Eye version 14.1.00000001.3.330.0.0.3.14 **Description** An issue was discovered in Siime Eye, which uses a default SSID value. This makes it easier for remote attackers to discover the physical locations of many Siime Eye devices, violating the privacy of users who do not wish to disclose their ownership of this type of device. Various resources, such as wigle.net, can be used for mapping SSIDs to physical locations. **Recommendations** To resolve the issue, update the Siime Eye device to the latest firmware and apply all recommended security patches. Ensure that the device is configured to use a unique SSID value instead of the default one. As a temporary workaround, consider disabling the device's wireless functionality until a patch is available. Restrict access to the device's network to minimize the risk of exploitation. Avoid using resources like wigle.net to map SSIDs to physical locations until the issue is resolved. Note: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Siime Eye version 14.1.00000001.3.330.0.0.3.14 **Description** An issue was discovered in Siime Eye where information on all users, including passwords, can be found in cleartext in a backup file created through the web interface. An attacker capable of accessing the web interface can create the backup file. **Recommendations** For Siime Eye version 14.1.00000001.3.330.0.0.3.14, as a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Additionally, avoid using the backup feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Siime Eye version 14.1.00000001.3.330.0.0.3.14 **Description** An issue was discovered in the software, where there is no CSRF protection. This issue affects multiple products, including Epson, Sannce, Svakom, and Tk-star. However, specific details about the affected versions of these products are not provided. To mitigate risks, it is recommended to update the software to the latest version and apply all available patches. **Recommendations** For Siime Eye version 14.1.00000001.3.330.0.0.3.14, update the software to the latest version to mitigate the risk of exploitation. As a temporary workaround, consider implementing CSRF protection measures until a patch is available. For other affected products, including Epson, Sannce, Svakom, and Tk-star, update to the latest firmware and apply all recommended patches to minimize the risk of exploitation.