Jimi Sebree

**Name of the Vulnerable Software and Affected Versions** Xerox FreeFlow Core version 8.0.4 **Description** A path traversal vulnerability exists in Xerox FreeFlow Core version 8.0.4, potentially allowing an attacker to access unauthorized files on the server. Successful exploitation of this issue can lead to Remote Code Execution (RCE), enabling the attacker to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Azure Health Bot (affected versions not specified) **Description** The issue is related to insufficient validation of incoming requests in Microsoft Azure Health Bot, which can be exploited by an authenticated attacker to elevate privileges over a network. This is a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer AX21 versions prior to 1.1.4 Build 20230219 **Description** An unauthenticated attacker can execute arbitrary commands with root privileges on the web management interface via a command injection issue. The flaw exists because the `country` parameter in the write operation of the '/cgi-bin/luci;stok=/locale' endpoint is not sanitized before being processed by the `popen()` function. This allows for remote code execution through a simple POST request. Real-world exploitation has been observed by Chinese state-linked actors and various botnets, including Mirai and Ballista. The Ballista botnet has compromised over 6,000 devices worldwide, specifically targeting sectors such as healthcare, manufacturing, and technology in countries including Brazil, Poland, Turkey, the UK, Mexico, China, Australia, and the USA. These compromised devices are used to build massive botnets for conducting DDoS attacks, including DNS reflection attacks, and establishing encrypted command-and-control channels to redirect users to phishing sites. **Recommendations** Update to firmware version 1.1.4 Build 20230219 or later. As a temporary workaround, restrict access to the '/cgi-bin/luci;stok=/locale' endpoint on the web management interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NETGEAR Nighthawk WiFi 6 Router versions prior to V1.0.10.94 **Description** The issue is related to the file sharing mechanism in the router's software, which incorrectly handles permissions. This can allow a remote attacker to execute arbitrary code on the device. The exploitation of this issue may enable unauthorized access and control. **Recommendations** For versions prior to V1.0.10.94, update the firmware to version V1.0.10.94 or later to resolve the issue. As a temporary workaround, consider restricting upload permissions for users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NETGEAR Nighthawk WiFi6 Router versions prior to V1.0.10.94 **Description** The issue is related to a buffer overflow vulnerability in the CGI mechanisms of the router's software. This vulnerability could allow an attacker to execute arbitrary code on the device. The vulnerability is associated with the lack of size checking for input data, which can be exploited by a remote attacker. **Recommendations** For versions prior to V1.0.10.94, update to version V1.0.10.94 or later to resolve the issue. As a temporary workaround, consider restricting access to the CGI mechanisms until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** NETGEAR Nighthawk WiFi6 Router versions prior to V1.0.10.94 **Description** The issue is related to the file sharing mechanism in the NETGEAR Nighthawk WiFi6 Router, which allows users with access to this feature to access arbitrary files on the device. This is due to insufficient access control in the file sharing component of the router's software. Exploitation of this issue may allow a remote attacker to gain access to arbitrary files. **Recommendations** For versions prior to V1.0.10.94, update to version V1.0.10.94 or later to resolve the issue. As a temporary workaround, consider restricting access to the file sharing feature until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Azure Arc Jumpstart (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability through registration files. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Site Recovery (affected versions not specified) **Description** The issue is related to insufficient access control in Azure Site Recovery, allowing an attacker to bypass security restrictions and elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01 Description: The issue concerns the storage of credentials in plaintext. Specifically, usernames and passwords are stored in plaintext in the config files on the device, such as the file /etc/config/cameo, which contains the admin password in plaintext. Recommendations: For version 2.08B01, consider changing the admin password and any other stored credentials to minimize the risk of exploitation, and look for updates that may address this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01 Description: The issue is related to the improper implementation of CSRF protections. Most pages lack proper usage of CSRF protections or mitigations. For pages that do use CSRF tokens, these tokens are trivially bypassable because the server does not validate them properly. This means an attacker could re-use an old token or find the token through some other method. Recommendations: For Trendnet AC2600 TEW-827DRU version 2.08B01, consider disabling access to pages that lack proper CSRF protections or mitigations until a patch is available. Restrict the use of pages that utilize CSRF tokens to minimize the risk of exploitation, as these tokens can be bypassed. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue concerns insufficient protections on the UART interface. A malicious actor with physical access to the device can connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. The default credentials are `admin` for both the username and password. Recommendations: For Netgear RAX43 version 1.0.3.96, consider changing the default credentials to secure ones and restrict physical access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the UART interface until a patch is available.

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue arises from the use of hardcoded credentials in the Netgear RAX43. Specifically, configuration backups are encrypted using a password-protected zip file with a hardcoded password `RAX50w!a4udk`. This allows a user to unzip the configuration, reconfigure settings not intended for manipulation, re-zip the configuration, and then restore the backup, thereby changing these settings. Recommendations: For Netgear RAX43 version 1.0.3.96, as a temporary workaround, consider restricting access to the configuration backup feature until a patch is available. Avoid using the hardcoded password `RAX50w!a4udk` to unzip and manipulate configuration settings. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue concerns the storage of sensitive information in plaintext. Specifically, all usernames and passwords for the device's associated services are stored in plaintext on the device. For instance, the admin password is stored in plaintext in the primary configuration file. Recommendations: For Netgear RAX43 version 1.0.3.96, consider changing the admin password and other sensitive credentials to minimize the risk of exploitation, and avoid using the device until a fix is available. As a temporary workaround, restrict access to the primary configuration file to prevent unauthorized access to the stored plaintext passwords.

Name of the Vulnerable Software and Affected Versions: Netgear Genie Installer for macOS (affected versions not specified) Description: The Netgear Genie Installer for macOS contains a local privilege escalation issue due to insecure file handling. A malicious actor with local access to the endpoint may overwrite certain files to obtain privilege escalation to root. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns a command injection vulnerability in the update functionality of the device. This vulnerability can be triggered by initiating a system update check via the SOAP interface, allowing command injection through preconfigured values. Recommendations: For Netgear Nighthawk R6700 version 1.0.4.120, consider disabling the update functionality via the SOAP interface until a patch is available. Restrict access to preconfigured values to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the lack of secure communication methods to the SOAP interface. By default, all communication to and from the device's SOAP Interface on port 5000 is sent via HTTP, causing potentially sensitive information, such as `username` and `password`, to be transmitted in cleartext. Recommendations: For Netgear Nighthawk R6700 version 1.0.4.120, consider disabling access to the SOAP interface on port 5000 until a secure communication method is implemented. Restrict access to the SOAP interface to minimize the risk of exploitation. Avoid using the SOAP interface for sensitive operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the storage of sensitive information in plaintext. Specifically, all usernames and passwords for the device's associated services are stored in plaintext on the device. For instance, the admin password is stored in plaintext in the primary configuration file on the device. Recommendations: For Netgear Nighthawk R6700 version 1.0.4.120, consider changing the admin password and other sensitive information to minimize the risk of exploitation. As a temporary workaround, restrict access to the primary configuration file to prevent unauthorized access to the stored plaintext passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netgear RAX43 version 1.0.3.96 **Description** The issue is related to the transmission of data in cleartext through the web interface of the affected device. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information using HTTP requests. The device communicates via HTTP by default, which results in sensitive information, such as usernames and passwords, being transmitted in cleartext. **Recommendations** For Netgear RAX43 version 1.0.3.96, consider configuring the device to use secure communication protocols, such as HTTPS, to protect sensitive information transmitted to and from the web interface. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netgear RAX43 version 1.0.3.96 **Description** The issue is related to a command injection vulnerability in the readycloud cgi application, specifically in the `name` parameter. This vulnerability is due to the lack of input data sanitization, which can allow a remote attacker to execute arbitrary commands. **Recommendations** For Netgear RAX43 version 1.0.3.96, as a temporary workaround, consider restricting access to the readycloud cgi application until a patch is available. Avoid using the `name` parameter in the affected application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netgear RAX43 version 1.0.3.96 **Description** The issue is caused by a buffer overrun vulnerability in the URL parsing functionality of the cgi-bin endpoint. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by potentially redirecting the control flow of the application. **Recommendations** For Netgear RAX43 version 1.0.3.96, consider restricting access to the cgi-bin endpoint until a patch is available. As a temporary workaround, avoid using the vulnerable URL parsing functionality in the cgi-bin endpoint to minimize the risk of exploitation.