Jake Valletta

**Name of the Vulnerable Software and Affected Versions** HP Support Assistant (affected versions not specified) **Description** The issue concerns potential security vulnerabilities, including compromise of integrity and allowed communication with untrusted clients. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HP Support Assistant (affected versions not specified) **Description** A security issue has been identified in the HP Support Assistant software, potentially compromising its integrity and allowing communication with untrusted clients. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ThroughTek Kalay Platform version 2.0 ThroughTek Kalay P2P SDK (affected versions not specified) **Description** The issue is related to the bypass of authentication via spoofing, allowing a remote attacker to compromise IoT devices and gain unauthorized access to protected information. An attacker can impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID), potentially resulting in the hijacking of a victim's connection and forcing them to supply credentials needed to access the victim TUTK device. It is estimated that 83 million devices connected to the Kalay network are at risk. The vulnerability can be exploited to gain access to streaming video and audio, compromise home networks and credentials, and create botnets from compromised devices. **Recommendations** For ThroughTek Kalay Platform version 2.0, update to the latest version Kalay 3.1.10 to resolve the issue. For ThroughTek Kalay P2P SDK, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Grandstream GRP261x VoIP phone version 1.0.3.6 (Base) Description: The issue allows Command Injection as root in the administrative web interface of the Grandstream GRP261x VoIP phone. Recommendations: For Grandstream GRP261x VoIP phone version 1.0.3.6 (Base), at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Grandstream GRP261x VoIP phone version 1.0.3.6 (Base) Description: The issue allows for authentication bypass in the administrative web interface of the Grandstream GRP261x VoIP phone. Recommendations: For Grandstream GRP261x VoIP phone version 1.0.3.6 (Base), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Tesla SolarCity Solar Monitoring Gateway versions through 5.46.43 Description: The issue is related to the use of hard-coded credentials. Specifically, Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the `python` user account. Recommendations: For Tesla SolarCity Solar Monitoring Gateway versions through 5.46.43, consider removing or securely storing the hard-coded credentials in the .pyc file used by Digi ConnectPort X2e to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Digi ConnectPort X2e versions prior to 3.2.30.6 **Description** The issue allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory. **Recommendations** For versions prior to 3.2.30.6, update to version 3.2.30.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the /WEB/python/.ssh directory and the S50dropbear.sh script to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cohesive Networks vns3:vpn appliances versions prior to 4.11.1 **Description** The administrative interface of the affected appliances is susceptible to authenticated remote code execution, which can result in server compromise. **Recommendations** For versions prior to 4.11.1, update to version 4.11.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android (affected versions not specified) **Description** The issue is related to a lack of proper validation of upstream interface names in the tethering controller, which can be exploited by attackers to bypass intended access restrictions. This can be achieved via a crafted application, allowing a remote attacker to circumvent existing access limitations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.