Michael Chan

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the bnxt en driver in the Linux kernel, specifically with the RX consumer index logic in the error path. In the `bnxt rx pkt()` function, the RX buffers are expected to complete in order. However, if the RX consumer index indicates an out of order buffer completion, it means a hardware bug is encountered, and the driver will abort all remaining RX packets and reset the RX ring. The RX consumer index passed to `bnxt discard rx()` is incorrect, and the current index (`tmp raw cons`) should be used instead of the old index (`raw cons`). This bug can cause the system to be at the wrong index when trying to abort the next RX packet, leading to a crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.