Howard Shrobe

The issue allows remote attackers to execute arbitrary commands on the device. This is achieved by exploiting an OS command injection vulnerability in the start arpping function of the timer binary. The vulnerability can be triggered by passing malicious input to the `dhcpd start`, `dhcpd end`, and `lan ipaddr` parameters in a POST request to the "apply.cgi" binary.

The issue allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication. This is due to a buffer overflow in the network.cgi.

The issue allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication. This is due to a buffer overflow in the video.cgi component.

The issue is related to a buffer overflow in the apply.cgi file, which can be exploited by crafting a POST request payload with authentication. This allows attackers to hijack the control flow to any location specified by the attacker.