Jincheng Wang

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S V3 versions prior to 3.441b260626 **Description** An authenticated OS command injection exists in the '/cgi-bin/httpuploadcert.cgi' endpoint. The issue occurs because the certificate password field is incorporated into a shell command without proper sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary operating-system commands on the device. **Recommendations** Update PLANET GS-4210-16P2S V3 to version 3.441b260626 or later. Avoid using the certificate password field in the '/cgi-bin/httpuploadcert.cgi' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S versions prior to 3.441b260626 **Description** Authenticated stack buffer overflows exist in the '/cgi-bin/dispatcher.cgi' endpoint. The issue occurs because the following handlers copy POST parameters into fixed-size stack buffers without proper length validation: - `web login first post` handler copies the `usrPass` parameter. - `web sys enablePasswd post` handler copies the `enbPass` parameter. - `web sys localUser post` handler copies the `usrName` and `usrPass` parameters. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, leading to a denial of service. **Recommendations** Update to version 3.441b260626 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S versions prior to 3.441b260626 **Description** Authenticated stack buffer overflow and null pointer dereference issues exist in the '/cgi-bin/dispatcher.cgi' endpoint. The `web radiusSrv* post` family of handlers copies the `radKey`, `radKey 0`, `radDftParamKey`, `radName`, and `radIp` POST parameters into fixed-size stack buffers without validating their length. Furthermore, the system dereferences `radName` and `radIp` without verifying if they are present in the request. A remote authenticated attacker can exploit these flaws by sending crafted requests to crash the CGI process or the web management service, leading to a denial of service. **Recommendations** Update PLANET GS-4210-16P2S to version 3.441b260626 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S versions prior to 3.441b260626 **Description** A pre-authentication memory corruption issue exists in the web management interface. The ` readHttpParam()` function copies an oversized HTTP query string without ensuring NUL termination, which allows the `parse query string()` function to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to the 'dispatcher.cgi' endpoint to cause a denial of service of the web management interface or potentially trigger memory corruption. **Recommendations** Update PLANET GS-4210-16P2S to version 3.441b260626 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S versions prior to 3.441b260626 **Description** An authenticated OS command injection flaw exists in the '/cgi-bin/dispatcher.cgi' endpoint. The `web vlan membership edit dialog post` handler fails to sanitize the `memberTags` POST parameter before incorporating it into a shell command. This allows a remote authenticated attacker to execute arbitrary operating-system commands on the device. **Recommendations** Update to version 3.441b260626 or later. Avoid using the `memberTags` parameter in the '/cgi-bin/dispatcher.cgi' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S versions prior to 3.441b260626 **Description** An authenticated null pointer dereference occurs in the '/cgi-bin/dispatcher.cgi' endpoint. The `web poe alive rmtip post` handler fails to verify the presence of the `rmtIP` parameter before dereferencing it. A remote authenticated attacker can send a crafted request omitting the `rmtIP` parameter, causing the CGI process to crash and resulting in a denial of service of the web management interface. **Recommendations** Update to version 3.441b260626 or later. Avoid using the `rmtIP` parameter in the '/cgi-bin/dispatcher.cgi' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S versions prior to 3.441b260626 **Description** An authenticated OS command injection exists in the '/cgi-bin/dispatcher.cgi' endpoint. The `web smtp test post` handler fails to sanitize the SMTP server value provided by the user before incorporating it into a shell command. A remote attacker with administrator web credentials can exploit this by sending a crafted SMTP server value to execute arbitrary operating-system commands on the device. **Recommendations** Update to version 3.441b260626 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET GS-4210-16P2S V3 versions prior to 3.441b260626 **Description** Multiple authenticated stack buffer overflow issues exist in the `/cgi-bin/dispatcher.cgi` endpoint. The vulnerability occurs when several handlers copy attacker-controlled POST parameters into fixed-size stack buffers without proper length validation. Affected handlers include `web vlan membership edit dialog post`, `web dai vlan post`, `web poe alive rmtip post`, `web sys sntp post`, `web tool upgradeManager post`, `web port countersClr post`, `web rmon statisticsClr post`, `web cablediag copper post`, `web aaa *Authlist*`, `web acl mgmt Rules Apply post`, `web acl mgmt Rules Edit post`, `web acl *AceDel post`, `web acl *AceAdd/Edit post`, `web acl bindAdd post`, `web acl bindEdit post`, `web snmp v3view add post`, `web snmp v3group add post`, `web snmp v3community add post`, `web snmp v3host add post`, `web snmp notifyv3 add post`, `web snmp v3user add post`, `web snmpv3 remote engineId add post`, `web stp globalSetting post`, `web isg db post`, `web tacplus* post`, `web dhcp option82 post`, and `web dhcp port option82 cid post`. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, leading to a denial of service. **Recommendations** Update to version 3.441b260626 or later.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A null pointer dereference occurs in the `formlogout()` function due to missing checks for an empty or absent Cookie header before string handling. A remote attacker with valid administrative credentials for the web management interface can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `apautotest()` function. The flaw stems from insufficient validation of the `CMD0`, `CMD3`, and `CMD6` fields before they are executed as commands. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `apautotest()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `pingtrace` function due to insufficient validation of the `host` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A buffer overflow exists in the `setLan()` function due to missing length checks during memory copy operations. This issue affects the `lanVlanId0`, `lanIp`, and `lanNetmask` fields. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to cause a denial of service or execute arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `webBackupAction()` function. The flaw stems from insufficient filtering of the `option`, `key`, `pw encode`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `sysreboot()` function. The flaw stems from insufficient filtering of the `config`, `act`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A pre-authentication command injection issue exists in the 'setget.cgi' interface. The flaw stems from insufficient filtering of the `pass` field before command execution, allowing a remote attacker to execute arbitrary commands with root privileges via crafted input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `dray apm` component. The flaw stems from insufficient validation of UDP message content following a `START SPEED TEST` request before the system executes commands. A remote attacker can exploit this by sending a specially crafted message to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `setLan()` function. The flaw stems from insufficient validation of the `lanIp` and `lanNetmask` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `mesh start speed test()` function. The flaw stems from insufficient sanitization of the `meshdevice index` and `meshdevice ip` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `jsonstatus()` function. The flaw stems from insufficient filtering of the `usescript`, `usefile`, and `option` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Volmarg Personal Management System (affected versions not specified) DrayTek VigorAP (affected versions not specified) **Description** Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET /public/get-file/{path}' endpoint. The `path` route parameter is passed to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form, allowing the retrieval of sensitive files accessible to the PHP-FPM worker process. DrayTek VigorAP models contain a command injection flaw in the `ExportSettings()` function. Insufficient filtering of the `backupkey`, `backuptype`, and `realtime` fields allows a remote attacker with administrative credentials to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.