Mark Lowe

The issue exists due to the incorrect enabling of debug mode for specific services, allowing an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges. An attacker could exploit this by connecting to the device and navigating to the service with debug mode enabled. A successful exploit could allow the attacker to execute arbitrary commands as the root user. The attacker would need to perform detailed reconnaissance to allow for unauthenticated access. The vulnerability can also be exploited by an authenticated attacker.

A vulnerability in the debug function of Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform debug actions, potentially disclosing confidential information. This issue arises from a debug service that incorrectly listens to and accepts incoming connections, allowing an attacker to connect to the debug port and execute debug commands, thereby viewing sensitive debugging information.

The vulnerability may lead to a breach of confidentiality, integrity, and availability of protected information. It can be exploited remotely. The QSharedMemory class in Qt uses weak permissions for shared memory segments, allowing local users to read sensitive information or modify critical program data.