Lewis Patten

A buffer overflow allows a remote attacker to execute arbitrary code via the 'set getparam.cgi' component. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is allocated to hold, potentially overwriting adjacent memory locations.

A remote buffer overflow occurs in the admin interface. An authenticated attacker can exploit this to execute arbitrary code with root privileges on the device via the '/cgi-bin/dido/setdo.cgi' endpoint.

A path traversal issue exists in the '/admin/downloadMedias.cgi' endpoint. This allows authenticated attackers to read arbitrary files on the device by sending a specially crafted request. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.