Georgiy Zaytsev

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns an insecure NTPT3 protocol in Ingenico Telium 2 POS terminals. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue allows for arbitrary code execution via the TRACE protocol. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue is a buffer overflow via SOCKET TASK in the NTPT3 protocol. This buffer overflow can be exploited, but details about real-world incidents or the estimated number of potentially affected devices are not provided. The buffer overflow occurs in the NTPT3 protocol, which is used by the Ingenico Telium 2 POS terminals. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the SOCKET TASK in the NTPT3 protocol until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns undeclared TRACE protocol commands in Ingenico Telium 2 POS terminals. This problem is resolved in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS Telium2 OS versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue allows bypass of file-reading restrictions via the NTPT3 protocol. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns hardcoded PPP credentials in Ingenico Telium 2 POS terminals. This allows unauthorized access. The problem is resolved in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to fix the hardcoded PPP credentials issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns an insecure TRACE protocol in Ingenico Telium 2 POS terminals. This problem is resolved in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider disabling the TRACE protocol until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue is a buffer overflow via the 0x26 command of the NTPT3 protocol. This protocol is used in Ingenico Telium 2 POS terminals. The buffer overflow can be exploited, but details about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited are not provided. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the 0x26 command of the NTPT3 protocol until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue is a buffer overflow that occurs via the `RemotePutFile` command of the NTPT3 protocol. This buffer overflow is fixed in Telium 2 SDK v9.32.03 patch N. Recommendations: For Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the `RemotePutFile` command of the NTPT3 protocol until the update is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns hardcoded FTP credentials in Ingenico Telium 2 POS terminals. This allows unauthorized access. The problem is fixed in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the FTP credentials until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Phoenix Contact FL SWITCH versions 1.0 through 1.33 **Description** The issue is caused by a buffer overflow in the memory of the menu pxc.cgi and index.cgi components of the managed switch firmware. This can be exploited by a remote attacker by sending a GET request with a specially crafted cookie, potentially allowing the execution of arbitrary code or causing a denial of service. **Recommendations** For versions 1.0 through 1.33, as a temporary workaround, consider restricting access to the vulnerable menu pxc.cgi and index.cgi components until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GMV Checker ATM Security versions prior to 5.0.18 **Description** The issue allows remote authenticated users to execute arbitrary code via unspecified vectors. It is caused by a buffer overflow in the memory, where an operation exceeds the buffer boundaries. This can enable a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 5.0.18, update to version 5.0.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected system to minimize the risk of exploitation.