Ezangel

**Name of the Vulnerable Software and Affected Versions** Tenda 5G03 version V05.03.02.04 (Version 1.0) **Description** Command injection is possible in the `action unlock sim()` function through the `pin` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `action unlock sim()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda 5G03 version V05.03.02.04 (Version 1.0) **Description** Command injection is possible in the `action radio on with ia apn()` function through the `ia` parameter. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the target machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `action radio on with ia apn()` function or avoid using the `ia` parameter.

**Name of the Vulnerable Software and Affected Versions** Tenda 5G03 version V05.03.02.04 (Version 1.0) **Description** Command injection is possible in the `action set volume()` function through the `volume` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `action set volume()` function or avoiding the use of the `volume` parameter.

**Name of the Vulnerable Software and Affected Versions** GL-iNet GL-AR300M16 version 4.3.11 **Description** The GL-iNet GL-AR300M16 device contains a command injection issue through the `module` parameter within the `M.get system log` function. This allows attackers to execute arbitrary commands by providing a crafted input. The vulnerability is present in the system log API, potentially leading to unauthorized remote code execution on travel routers. **Recommendations** GL-iNet GL-AR300M16 version 4.3.11: As a temporary workaround, consider disabling access to the `M.get system log` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mercury D196G version d196gv1-cn-up 2020-01-09 11.21.44 **Description** A buffer overflow condition exists in the Mercury D196G router. This issue is present in the `sub 404CAEDC` function and is triggered by the `password` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercury D196G version d196gv1-cn-up 2020-01-09 11.21.44 **Description** The software is susceptible to a buffer overflow issue. This occurs in the `sub 404CAEDC` function through the `fac password` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link TL-WDR7660 version 1.0 **Description** The issue is related to the `guestRuleJsonToBin()` function, which handles the `string name` parameter without validation, potentially leading to a stack overflow. This can be exploited by a remote attacker using a specially crafted HTTP request, resulting in a denial of service. **Recommendations** For TP-Link TL-WDR7660 version 1.0, as a temporary workaround, consider disabling the `guestRuleJsonToBin()` function until a patch is available. Restrict access to the vulnerable guest function to minimize the risk of exploitation. Avoid using the `string name` parameter in the affected HTTP endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.