Gabriel Vía Echezarreta

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: An attacker with no knowledge of the current users in the web application could build a dictionary of potential users and check the server responses, as it indicates whether or not the user is present. Recommendations: For CIRCUTOR Q-SMT version 1.0.4, consider restricting access to the user enumeration functionality until a patch is available. As a temporary workaround, limit the number of login attempts to prevent brute-force attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: The issue allows an attacker with access to the web service to bypass authentication mechanisms on the login page, enabling them to use all functionalities implemented at the web level that allow interacting with the device, potentially leading to a denial of service (DoS) attack. Recommendations: For version 1.0.4, consider restricting access to the web service until a patch is available, and ensure that authentication mechanisms are properly secured to prevent bypassing. As a temporary workaround, limit the use of functionalities implemented at the web level to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: An attacker with access to the network where CIRCUTOR Q-SMT is located could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. Recommendations: For CIRCUTOR Q-SMT version 1.0.4, consider implementing token expiration to restrict access to the web application. As a temporary workaround, restrict access to the network where CIRCUTOR Q-SMT is located to minimize the risk of token theft. Additionally, monitor network activity and locally stored web information for potential security breaches. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue involves an incorrect validation vulnerability of the data entered. This allows an attacker with access to the network on which the affected device is located to use the discovery port protocol (1925/UDP) to obtain device-specific information without the need for authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue is related to an incorrect data input validation vulnerability. This could allow an attacker with network access to use fuzzing techniques, gaining knowledge about specially crafted packets. These packets could create a Denial of Service (DoS) condition through the MMS protocol when communication is initiated, leading to a complete system reboot of the device and its services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue is related to an incorrect data input validation vulnerability. This could allow an attacker with network access to use fuzzing techniques, gaining knowledge about specially crafted packets. These packets could create a Denial of Service (DoS) condition through the MMS protocol when communication is initiated, leading to a complete system reboot of the device and its services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Landis+Gyr E850 (ZMQ200) versions all **Description** The device's web application navigation depends on the value of the `session cookie`. If an attacker changes the `session cookie` values, the web application could become inaccessible for the user. This issue is related to the reliance on cookies without validation and integrity. **Recommendations** For all versions, consider implementing cookie validation and integrity checks to prevent unauthorized modifications. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.