Ibrahim Ayadhi

**Name of the Vulnerable Software and Affected Versions** QuLog Center versions prior to 1.7.0.829 QuLog Center versions prior to 1.8.0.888 QTS versions prior to 4.5.4.2957 build 20241119 QuTS hero versions prior to 4.5.4.2956 build 20241119 **Description** A server-side request forgery (SSRF) issue has been identified, which could allow remote attackers with administrator access to read application data. **Recommendations** For QuLog Center versions prior to 1.7.0.829, update to version 1.7.0.829 or later. For QuLog Center versions prior to 1.8.0.888, update to version 1.8.0.888 or later. For QTS versions prior to 4.5.4.2957 build 20241119, update to version 4.5.4.2957 build 20241119 or later. For QuTS hero versions prior to 4.5.4.2956 build 20241119, update to version 4.5.4.2956 build 20241119 or later.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions prior to 5.0.1.2514 build 20230906 QNAP QTS versions prior to 5.1.1.2491 build 20230815 QNAP QuTS hero h versions prior to h5.0.1.2515 build 20230907 QNAP QuTS hero h versions prior to h5.1.1.2488 build 20230812 QNAP QuTScloud c versions prior to c5.1.0.2498 **Description** A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. **Recommendations** For QNAP QTS versions prior to 5.0.1.2514 build 20230906, update to QTS 5.0.1.2514 build 20230906 or later. For QNAP QTS versions prior to 5.1.1.2491 build 20230815, update to QTS 5.1.1.2491 build 20230815 or later. For QNAP QuTS hero h versions prior to h5.0.1.2515 build 20230907, update to QuTS hero h5.0.1.2515 build 20230907 or later. For QNAP QuTS hero h versions prior to h5.1.1.2488 build 20230812, update to QuTS hero h5.1.1.2488 build 20230812 or later. For QNAP QuTScloud c versions prior to c5.1.0.2498, update to QuTScloud c5.1.0.2498 or later.

**Name of the Vulnerable Software and Affected Versions** Camera devices by UDP Technology, Geutebrück and other vendors (affected versions not specified) **Description** The issue concerns command injection, which may allow an attacker to remotely execute arbitrary code. This affects multiple camera devices from various vendors, including UDP Technology and Geutebrück. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UDP Technology camera devices (affected versions not specified) Geutebrück camera devices (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow condition in the `profile` parameter. This may allow an attacker to remotely execute arbitrary code. Multiple camera devices from various vendors, including UDP Technology and Geutebrück, are affected. **Recommendations** For UDP Technology camera devices, restrict access to the `profile` parameter to minimize the risk of exploitation. For Geutebrück camera devices, avoid using the `profile` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Geutebrück camera devices (affected versions not specified) UDP Technology camera devices (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow condition in the `action` parameter, potentially allowing an attacker to remotely execute arbitrary code. **Recommendations** For Geutebrück camera devices, avoid using the `action` parameter in affected API endpoints until the issue is resolved. For UDP Technology camera devices, restrict access to the vulnerable module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Camera devices by UDP Technology, Geutebrück and other vendors (affected versions not specified) **Description** The issue concerns command injection, which may allow an attacker to remotely execute arbitrary code on multiple camera devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.