F. Lienhart

An issue was discovered in the binary file /usr/local/sbin/webproject/set param.cgi, which contains hardcoded credentials to the web application. These accounts are considered backdoor accounts because they cannot be deactivated or have their passwords changed. The exploitation of this issue may allow a remote attacker to elevate their privileges.

The issue is related to a potential buffer overflow in the firmware of Infiray IRAY-A8Z3, caused by the function `strcpy()` being called without checking the string length beforehand. This could allow a remote attacker to execute arbitrary code.

The issue is related to the webserver of the Infiray IRAY-A8Z3, which contains an endpoint that can execute arbitrary commands. This can be achieved by manipulating the `cmd string` URL parameter. The vulnerability is associated with incorrect code generation management, allowing an attacker to execute arbitrary code using the `cmd string` parameter.

An issue was discovered in Infiray IRAY-A8Z3, where there is a blank root password for TELNET by default. This allows an attacker to gain root privileges by connecting through port 23.