Jakub Buczak

Incorrect permission assignment for a critical resource allows a local user to bypass the driver validation mechanism. This leads to unauthorized read and write access to physical memory.

A stored cross-site scripting (XSS) attack could be conducted by an unauthenticated, remote attacker against a user of the web-based management interface on an affected device. This issue is due to insufficient validation of user-supplied input by the interface. An attacker could exploit this by injecting malicious code into specific pages, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.