Jincheng Wang

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.

An authenticated null pointer dereference occurs in the '/cgi-bin/dispatcher.cgi' endpoint. The `web poe alive rmtip post` handler fails to verify the presence of the `rmtIP` parameter before dereferencing it. A remote authenticated attacker can send a crafted request omitting the `rmtIP` parameter, causing the CGI process to crash and resulting in a denial of service of the web management interface.

Authenticated stack buffer overflow and null pointer dereference issues exist in the '/cgi-bin/dispatcher.cgi' endpoint. The `web radiusSrv* post` family of handlers copies the `radKey`, `radKey 0`, `radDftParamKey`, `radName`, and `radIp` POST parameters into fixed-size stack buffers without validating their length. Furthermore, the system dereferences `radName` and `radIp` without verifying if they are present in the request. A remote authenticated attacker can exploit these flaws by sending crafted requests to crash the CGI process or the web management service, leading to a denial of service.

A pre-authentication memory corruption issue exists in the web management interface. The ` readHttpParam()` function copies an oversized HTTP query string without ensuring NUL termination, which allows the `parse query string()` function to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to the 'dispatcher.cgi' endpoint to cause a denial of service of the web management interface or potentially trigger memory corruption.

An authenticated OS command injection flaw exists in the '/cgi-bin/dispatcher.cgi' endpoint. The `web vlan membership edit dialog post` handler fails to sanitize the `memberTags` POST parameter before incorporating it into a shell command. This allows a remote authenticated attacker to execute arbitrary operating-system commands on the device.

An authenticated OS command injection exists in the '/cgi-bin/httpuploadcert.cgi' endpoint. The issue occurs because the certificate password field is incorporated into a shell command without proper sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary operating-system commands on the device.

An authenticated OS command injection exists in the '/cgi-bin/dispatcher.cgi' endpoint. The `web smtp test post` handler fails to sanitize the SMTP server value provided by the user before incorporating it into a shell command. A remote attacker with administrator web credentials can exploit this by sending a crafted SMTP server value to execute arbitrary operating-system commands on the device.

Multiple authenticated stack buffer overflow issues exist in the `/cgi-bin/dispatcher.cgi` endpoint. The vulnerability occurs when several handlers copy attacker-controlled POST parameters into fixed-size stack buffers without proper length validation. Affected handlers include `web vlan membership edit dialog post`, `web dai vlan post`, `web poe alive rmtip post`, `web sys sntp post`, `web tool upgradeManager post`, `web port countersClr post`, `web rmon statisticsClr post`, `web cablediag copper post`, `web aaa *Authlist*`, `web acl mgmt Rules Apply post`, `web acl mgmt Rules Edit post`, `web acl *AceDel post`, `web acl *AceAdd/Edit post`, `web acl bindAdd post`, `web acl bindEdit post`, `web snmp v3view add post`, `web snmp v3group add post`, `web snmp v3community add post`, `web snmp v3host add post`, `web snmp notifyv3 add post`, `web snmp v3user add post`, `web snmpv3 remote engineId add post`, `web stp globalSetting post`, `web isg db post`, `web tacplus* post`, `web dhcp option82 post`, and `web dhcp port option82 cid post`. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, leading to a denial of service.

Authenticated stack buffer overflows exist in the '/cgi-bin/dispatcher.cgi' endpoint. The issue occurs because the following handlers copy POST parameters into fixed-size stack buffers without proper length validation: - `web login first post` handler copies the `usrPass` parameter. - `web sys enablePasswd post` handler copies the `enbPass` parameter. - `web sys localUser post` handler copies the `usrName` and `usrPass` parameters. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, leading to a denial of service.

A command injection issue exists in the `sysreboot()` function. The flaw stems from insufficient filtering of the `config`, `act`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `apautotest()` function. The flaw stems from insufficient validation of the `CMD0`, `CMD3`, and `CMD6` fields before they are executed as commands. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `pingtrace` function due to insufficient validation of the `host` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host machine.

A command injection issue exists in the `InquierTime()` function. The flaw stems from insufficient filtering of the `time` field before it is used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `webBackupAction()` function. The flaw stems from insufficient filtering of the `option`, `key`, `pw encode`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A null pointer dereference occurs in the `formlogout()` function due to missing checks for an empty or absent Cookie header before string handling. A remote attacker with valid administrative credentials for the web management interface can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

A command injection issue exists in the `dray apm` component. The flaw stems from insufficient validation of UDP message content following a `START SPEED TEST` request before the system executes commands. A remote attacker can exploit this by sending a specially crafted message to execute arbitrary commands with root privileges.

Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET /public/get-file/{path}' endpoint. The `path` route parameter is passed to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form, allowing the retrieval of sensitive files accessible to the PHP-FPM worker process. DrayTek VigorAP models contain a command injection flaw in the `ExportSettings()` function. Insufficient filtering of the `backupkey`, `backuptype`, and `realtime` fields allows a remote attacker with administrative credentials to execute arbitrary commands with root privileges.

A command injection issue exists in the `setcamset()` function. The flaw stems from insufficient filtering of the `selectSlaves` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `jsonstatus()` function. The flaw stems from insufficient filtering of the `usescript`, `usefile`, and `option` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `tr069TestInform()` function. The flaw arises from insufficient filtering of dangerous characters before the `event code` field is concatenated into a system command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.