Marcin Kozlowski

**Name of the Vulnerable Software and Affected Versions** Automatic-Systems SOC FL9600 FastLine lego T04E00 (affected versions not specified) **Description** The issue allows a remote attacker to obtain sensitive information via a directory traversal attack. This can be achieved by exploiting the `csvServer.php` endpoint with a specially crafted `dir` parameter containing a `..` sequence. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `csvServer.php` endpoint to minimize the risk of exploitation. Avoid using the `dir` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Automatic Systems SOC FL9600 FirstLane version V06 lego T04E00 Automatic Systems SOC FL9600 FastLine version v.legoT04E00 **Description** An issue in Automatic Systems SOC FL9600 allows a remote attacker to obtain sensitive information because there is an automatic systems super admin account with a hardcoded password, specifically `astech`. The attacker can exploit this via the admin login credentials. **Recommendations** For version V06 lego T04E00, consider changing the hardcoded password `astech` for the super admin account to prevent unauthorized access. For version v.legoT04E00, restrict access to the admin login credentials to minimize the risk of exploitation. As a temporary workaround, consider disabling the admin login feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The `aqc111 rx fixup()` function in the Linux kernel contains multiple out-of-bounds accesses that can be triggered by a defective or malicious USB device. These issues include the metadata array potentially being out of bounds, leading to out-of-bounds reads and endianness flips on big-endian systems. Additionally, a packet may overlap the metadata array, causing subsequent endianness flips to corrupt data in a cloned SKB (Socket Buffer) already processed by the network stack. Furthermore, a packet SKB can be created with a tail extending far beyond its end, resulting in out-of-bounds heap data being treated as part of the SKB data. This can impact the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 7.0 through 9 **Description** The issue is related to a missing bounds check in the `ihevcd parse pps` function of `ihevcd parse headers.c`, which could lead to a possible out of bounds write. This might result in remote code execution without requiring additional execution privileges. User interaction is necessary for exploitation. **Recommendations** For Android versions 7.0 through 9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.4.4 through 8.0 **Description** A remote code execution issue in the Android system's Bluetooth component is related to buffer overflow errors in dynamic memory. This can allow a remote attacker to cause a buffer overflow and execute arbitrary code on the device. **Recommendations** For Android versions 4.4.4 through 8.0, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to Windows XP SP3 Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4 Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Professional SP4 Microsoft Message Queuing (MSMQ) service in Microsoft Windows XP SP2 Description: A stack-based buffer overflow issue exists in the Microsoft Message Queuing (MSMQ) service, allowing attackers to execute arbitrary code via a long string in an opnum 0x06 RPC call to port 2103. This issue is remotely exploitable on Windows 2000 Server. The vulnerability occurs when the Message Queuing Service incorrectly validates input strings before passing them to a buffer. An attacker could exploit this by constructing a specially crafted MSMQ message, potentially allowing remote code execution on Microsoft Windows 2000 and local elevation of privilege on Windows XP. Recommendations: For Microsoft Windows 2000 Server SP4, consider disabling the MSMQ service until a patch is available. For Microsoft Windows 2000 Professional SP4, restrict access to the MSMQ service to minimize the risk of exploitation. For Microsoft Windows XP SP2, avoid using the MSMQ service in a local scenario until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.