Georgy Zaytsev

The issue is related to a bug in a data parsing module of Kaspersky Anti-Virus products, which potentially allowed an attacker to execute arbitrary code. This bug is also associated with unlimited resource allocation. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

The WebUI of the affected devices leaks private information in firmware images.

The WebUI of the affected devices allows for plaintext transmission of user credentials by default, which can be done over HTTP.

The WebUI of the affected device is susceptible to a denial-of-service attack. This can be achieved by establishing more than 120 connections.

The WebUI of the affected device is susceptible to brute-force attacks due to improper restriction of excessive authentication attempts. This allows attackers to attempt numerous login combinations without significant impediment.

The issue is caused by a buffer overflow in the memory of the menu pxc.cgi and index.cgi components of the managed switch firmware. This can be exploited by a remote attacker by sending a GET request with a specially crafted cookie, potentially allowing the execution of arbitrary code or causing a denial of service.

The issue is related to the use of hard-coded credentials for the console configuration of Moxa Ethernet switches. Exploitation of this issue may allow an attacker to elevate their privileges.

The issue is related to the use of a weak cryptographic algorithm in the firmware of the affected products. This weakness may allow an attacker to disclose confidential information. The vulnerability can be exploited remotely.