Jacob Baines

These devices ship with a backdoor command-and-control implant called `yunmgrd`. This implant communicates via an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker positioned on the network path can hijack this channel to execute arbitrary commands with root privileges. Additionally, the attacker can modify DNS entries, exfiltrate PPPoE credentials, and establish reverse SSH tunnels.

The `infosrvd` service, which listens on the UDP/9992 endpoint, contains an unauthenticated command injection. A remote attacker can send a specially crafted UDP packet to execute arbitrary commands with root privileges. The authentication mechanism is ineffective because it relies on a hardcoded salt and an all-zero wildcard MAC bypass.

Zbtlink router firmware contains an embedded remote-control implant known as ENDLESSDOORS, which is integrated as an OpenWrt package (`librctl.so`). The implant runs as root under the process name `kworker` to mimic kernel threads. It establishes an unauthenticated, cleartext TCP connection to a hardcoded command-and-control server using port 7000 for commands and port 7001 for interactive-shell callbacks. The implant uses the `popen()` function to execute received strings as root (uid=0), and a specific `rctlbash` command provides an interactive root shell. Due to the lack of authentication and encryption, any entity capable of intercepting the network path or controlling the C2 address can achieve unauthenticated remote code execution as root.

The issue is related to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests.

The issue concerns an authentication bypass in the administrative web server of the Four-Faith F3x36 router. Specifically, authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. This allows a remote and unauthenticated user to modify settings or chain with existing authenticated vulnerabilities.

Name of the Vulnerable Software and Affected Versions: Netgear FVS336Gv2 (affected versions not specified) Netgear FVS336Gv3 (affected versions not specified) Description: The issue concerns a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted `util backup configuration` commands. Recommendations: For Netgear FVS336Gv2, consider disabling the Telnet interface until a patch is available. For Netgear FVS336Gv3, restrict access to the `util backup configuration` command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability in the upload module could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This issue is due to insufficient boundary checks when processing specific HTTP requests. An attacker could exploit this by sending crafted HTTP requests to an affected device, potentially allowing the execution of arbitrary code as the root user on the underlying operating system.

The issue is a code execution vulnerability affecting ASUS routers that support custom OpenVPN profiles. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile.

The issue is related to a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. The affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

The web server used by MikroTik RouterOS is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted.

The issue is related to a violation of secure design principles in the communication of CAMS for HIS. An adjacent attacker can compromise a computer using CAMS for HIS software and use credentials from the compromised machine to access data from another machine using CAMS for HIS software. This can lead to a disabling of CAMS for HIS software functions on any affected machines, or information disclosure/alteration.

The issue is related to insufficient access restrictions in the Windows Print Spooler service, allowing a remote attacker to execute arbitrary code with SYSTEM privileges by loading a malicious DLL library. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. This issue is related to errors in input data validation. An attacker can exploit this to execute shell commands as root or inject HTML in password recovery emails.

The issue is related to a denial of service due to a use after free, where a remote unauthenticated attacker can crash the server by sending multiple HTTP POST requests. This causes the `retrieve url()` function to use a freed variable, leading to the denial of service.

The issue is related to a denial of service vulnerability caused by a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request to a vulnerable API endpoint, such as "/api/elog".

The issue allows a remote attacker to poison the router's DNS cache via malicious responses with additional and untrue records. This is due to the router adding all A records to its DNS cache even when the records are unrelated to the domain that was queried. The vulnerability exists because of insufficient input validation, which can allow an attacker to cause damage to the integrity of the data in the DNS system.

The issue allows an unauthenticated, remote person to access the HTTP endpoint "/videotalk" without requiring authentication. This could potentially allow the person to listen to the audio of the capturing device.

The issue is related to errors in the authorization procedure of the web-based management interface, which could allow a remote attacker to access protected information. Specifically, the vulnerability is due to improper authorization of an HTTP request, allowing an unauthenticated attacker to access the syslog file on an affected device by accessing its URL.

The issue allows a remote, unauthenticated attacker to execute operating system commands as root via command injection through the "file transfer.cgi" HTTP endpoint.

The issue is related to directory traversal errors in the restricted access directory path. An authenticated, remote attack can exploit this to read and write files outside of the sandbox directory (/rw/disk) via the HTTP or Winbox interfaces.