Mccaulay Hudson

A heap overflow in the `iked` process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. A heap overflow occurs when a program writes more data to a heap-allocated memory block than it can hold, potentially corrupting memory and allowing for code execution.

A type confusion issue in the iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. Type confusion occurs when a program accesses a resource using a different type than it was originally intended, leading to memory corruption or unexpected behavior.

An integer underflow in the `iked` process allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic. An integer underflow occurs when an arithmetic operation results in a value smaller than the minimum value the variable can hold, often causing the system to wrap around to a very large positive number.

A buffer overflow in the UPnP `AddPortMapping()` command allows an adjacent attacker to cause a temporary denial-of-service (DoS) condition, which is a state where a system becomes unavailable to its intended users, specifically affecting the UPnP function of the device.

A buffer overflow occurs in the UPnP `DeletePortMapping()` command. This allows an adjacent attacker to cause a temporary denial-of-service (DoS) condition, which is a state where a system or network becomes unavailable to its intended users, specifically affecting the UPnP function of the device.

The Tesla Telematics Control Unit (TCU) firmware is susceptible to an authentication bypass. The TCU operates the Android Debug Bridge (adbd) with root privileges. Despite a security check intended to disable adb shell access, adb push/pull and adb forward functionalities remain accessible. An attacker with physical access can exploit this by writing an arbitrary file to a writable location and subsequently overwriting the kernel’s `uevent helper` or `/proc/sys/kernel/hotplug` entries through ADB. This allows for the execution of scripts with root privileges.

An unauthenticated remote attacker can use this issue to change the device configuration due to a file being writeable for a short time after system startup.

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user `user-app` to the default password. The issue is related to insecure default resource initialization.

The issue is related to the `loadAsync` function in JSZip, which allows directory traversal via a crafted ZIP archive. This can be exploited by a remote attacker to write arbitrary files and execute arbitrary commands using a specially crafted malicious ZIP archive.