Josep Pi Rodriguez

**Name of the Vulnerable Software and Affected Versions** Moog EXO Series versions EXVF5C-2 and EXVP7C2-3 **Description** The issue concerns several XML External Entity (XXE) vulnerabilities. These vulnerabilities allow remote unauthenticated users to read arbitrary files by using a crafted Document Type Definition (DTD) in an XML request. **Recommendations** For Moog EXO Series versions EXVF5C-2 and EXVP7C2-3, consider disabling the XML parsing functionality until a patch is available. Restrict access to the XML request handling module to minimize the risk of exploitation. Avoid using crafted DTDs in XML requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Moog EXO Series versions (affected versions not specified) **Description** The administration console of the Moog EXO Series units has a feature that allows spawning a process repeatedly at a certain time interval as 'root'. This feature can be exploited by using special shell variables, such as `${IFS}`, to execute arbitrary commands as 'root' on the units. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moog EXO Series versions EXVF5C-2 and EXVP7C2-3 **Description** A security issue was found in the Moog EXO Series units that support the ONVIF interoperability protocol. The authentication check for certain ONVIF operations can be bypassed, allowing an attacker to execute privileged operations without authentication. This could enable the creation of a new Administrator user. **Recommendations** For Moog EXO Series versions EXVF5C-2 and EXVP7C2-3, as a temporary workaround, consider disabling the ONVIF protocol until a patch is available. Restrict access to privileged operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Moog EXO Series EXVF5C-2 and EXVP7C2-3 units (affected versions not specified) **Description** The issue concerns a hardcoded credentials vulnerability, which could lead to confidentiality issues when using the FTP, Telnet, or SSH protocols. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FuzeZip version 1.0.0.131625 Description: The issue is related to a Local Buffer Overflow. Recommendations: For FuzeZip version 1.0.0.131625, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Everest PeakHMI versions prior to 8.7.0.2 **Description** The issue allows remote attackers to cause a denial of service, resulting in an incorrect pointer dereference and daemon crash, via a crafted packet when the video server is used. **Recommendations** For versions prior to 8.7.0.2, update to version 8.7.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Retrospect versions prior to 10.0.2.119 on Windows Retrospect versions prior to 12.0.2.116 on OS X Retrospect versions prior to 10.0.2.104 on Linux Retrospect Client versions prior to 10.0.2.119 on Windows Retrospect Client versions prior to 12.0.2.116 on OS X Retrospect Client versions prior to 10.0.2.104 on Linux **Description** The issue improperly generates password hashes, making it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision. **Recommendations** For Retrospect and Retrospect Client on Windows, update to version 10.0.2.119 or later. For Retrospect and Retrospect Client on OS X, update to version 12.0.2.116 or later. For Retrospect and Retrospect Client on Linux, update to version 10.0.2.104 or later.

**Name of the Vulnerable Software and Affected Versions** CODESYS Gateway Server versions prior to 2.3.9.34 **Description** The issue is related to multiple heap-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved via specific opcodes, including `0x3ef` and `0x3f0`. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 2.3.9.34, update to version 2.3.9.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the `0x3ef` and `0x3f0` opcodes until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Dell Netvault Backup versions prior to 10.0.5 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, via a crafted request. **Recommendations** For versions prior to 10.0.5, update to version 10.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SCADA Engine BACnet OPC Server versions prior to 2.1.371.24 **Description** A heap-based buffer overflow issue exists in the SOAP web interface, allowing remote attackers to execute arbitrary code via a crafted packet. **Recommendations** For versions prior to 2.1.371.24, update to version 2.1.371.24 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SCADA Engine BACnet OPC Server versions prior to 2.1.371.24 **Description** The issue allows remote attackers to bypass authentication and read or write to arbitrary database fields. **Recommendations** For versions prior to 2.1.371.24, update to version 2.1.371.24 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SCADA Engine BACnet OPC Server versions prior to 2.1.371.24 **Description** The issue is related to a format string vulnerability in the BACnOPCServer.exe component, specifically in the SOAP web interface. This vulnerability allows remote attackers to execute arbitrary code by including format string specifiers in a request. **Recommendations** For versions prior to 2.1.371.24, update to version 2.1.371.24 or later to resolve the issue.