Knudsec

**Name of the Vulnerable Software and Affected Versions** F-logic DataCube3 version 1.0 **Description** The issue is a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface. **Recommendations** For F-logic DataCube3 version 1.0, consider implementing proper input sanitization to prevent the execution of arbitrary JavaScript code. As a temporary workaround, restrict access to the web management interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** F-logic DataCube3 version 1.0 **Description** The issue allows an unauthenticated malicious actor to execute arbitrary SQL queries in the database due to unauthenticated SQL injection. **Recommendations** For F-logic DataCube3 version 1.0, consider restricting access to the database to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** F-logic DataCube3 version 1.0 **Description** The issue is related to insufficient access control in the F-logic DataCube3 terminal measurement system software for power generation systems. This can be exploited by an unauthenticated, remote attacker to obtain the root and admin account passwords. The exploitation involves sending a URI with the path of the configuration file, taking advantage of improper directory access restrictions. **Recommendations** For F-logic DataCube3 version 1.0, consider restricting access to the configuration file and implementing proper directory access controls to prevent unauthorized access until a patch is available. As a temporary workaround, limit remote access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** F-logic DataCube3 version 1.0 **Description** The issue is related to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of a dangerous type by manipulating the filename extension. This could potentially enable a remote attacker to execute arbitrary code. **Recommendations** For F-logic DataCube3 version 1.0, consider restricting file uploads to only allow specific, safe file types until a patch is available. As a temporary workaround, disabling file upload functionality may help minimize the risk of exploitation.