Martin Zeiser

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-VMS V20 version 20.0.2 **Description** A stack overflow exists in the WebCam Server Login functionality. An unauthenticated attacker can send a specially crafted HTTP request to trigger the issue, potentially leading to arbitrary code execution with SYSTEM privileges. The flaw occurs because the `sscanf()` function is used to split the `Buffer` variable into `username` and `password` variables without limiting the size of the extracted content. If either the `username` or `password` decoded from the authorization string exceeds 40 characters, a stack overflow occurs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-VMS V20 version 20.0.2 **Description** A stack overflow in the WebCam Server Login functionality allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted HTTP request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-IP Device Utility version 9.0.5 **Description** Insufficient encryption in the Device Authentication functionality allows for the leak of credentials. When the utility sends privileged commands to devices over UDP, the username and password are encrypted using a symmetric key that is also included within the same packet. An attacker on the same local area network can listen to these broadcast messages and decrypt the credentials, potentially gaining full control over the device configuration to change the IP address or reset the device to factory defaults. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** Multiple reflected cross-site scripting (XSS) issues exist in the Web Interface / 'ssi.cgi' functionality. A reflected XSS occurs when an application includes untrusted data in a web page without proper validation, allowing an attacker to execute malicious scripts in the victim's browser. In this case, a specially crafted URL, specifically through the error message generated when requesting a non-existing page, can lead to arbitrary JavaScript code execution. **Recommendations** As a temporary workaround, restrict access to the 'ssi.cgi' functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** An OS command injection flaw exists in the 'DdnsSetting.cgi' functionality. A specially crafted DDNS configuration allows an attacker to modify a configuration value to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** The Web Interface functionality contains a flaw where session cookies are guessable. An attacker can use a series of specially crafted HTTP requests to brute-force these cookies, allowing them to bypass the authentication process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** Multiple reflected cross-site scripting (XSS) issues exist in the Web Interface / 'ssi.cgi' functionality. A reflected XSS occurs when an application includes untrusted data in a web page without proper validation, allowing an attacker to execute malicious scripts in the victim's browser. An attacker can use a specially crafted URL to trigger the execution of arbitrary JavaScript code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** A privilege escalation issue exists in the Web Interface functionality, specifically within the 'ssi.cgi' endpoint. A specially crafted HTTP request can lead to the leak of Administrator credentials, which an attacker can trigger by visiting a webpage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** A privilege escalation issue exists in the Web Interface functionality. A specially crafted HTTP request allows an attacker to execute privileged operations by visiting a specific webpage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GV-VMS version V20 **Description** A stack overflow exists in the WebCam Server component of the video monitoring software. When remote access is enabled, the `gvapi` endpoint utilizes a specific authentication mechanism via an `HTTP Authorization` header, supporting both Basic and Digest modes. The issue occurs because a base64 decoded string, stored in the `b64decoder` variable, is copied into the `Buffer` stack variable without a bound-check. If the decoded string exceeds 256 characters, a stack overflow is triggered. Since the web server is compiled without ASLR (Address Space Layout Randomization), a security technique that randomly arranges the address space positions of key data areas to prevent memory corruption attacks, an attacker can gain full code execution with SYSTEM privileges on the host machine. **Recommendations** Update GV-VMS version V20 to a patched version. Disable the remote access WebCam Server feature to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Bachmann Visutec GmbH Atvise versions 3.5.4 through 3.7 **Description** An information disclosure issue exists in the License registration functionality. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this issue. **Recommendations** For versions 3.5.4 through 3.7, consider disabling the License registration functionality until a patch is available to prevent exploitation. Restrict access to sensitive areas of the application to minimize the risk of login credential disclosure.

**Name of the Vulnerable Software and Affected Versions** GmbH Komoot versions 10.26.9 through 11.1.11 **Description** An information disclosure issue exists in the Friend finder functionality. A specially crafted series of network requests can lead to the disclosure of sensitive information. **Recommendations** For versions 10.26.9 through 11.1.11, update to a version later than 11.1.11 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** EIP Stack Group OpENer version 2.3 **Description** An information disclosure issue exists in the Ethernet/IP UDP handler functionality. A specially crafted network request can lead to an out-of-bounds read. **Recommendations** For EIP Stack Group OpENer version 2.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.