Mrbruh

**Name of the Vulnerable Software and Affected Versions** WebUI ISP (affected versions not specified) **Description** A Zip Slip issue exists in the ISP Upgrade functionality of the WebUI. This occurs when the system fails to properly validate archives, allowing an authenticated administrator to perform arbitrary file writes via a crafted archive containing directory traversal sequences. Directory traversal is a technique used to access files and directories that are stored outside the web root folder. Successful exploitation can lead to the overwriting of arbitrary files on the underlying system, compromising system integrity and availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link TL-MR6400 version 5.3 **Description** A command injection issue exists in the Telnet command-line interface (CLI) of the device. This is due to inadequate data sanitization during certain CLI operations. An authenticated attacker with elevated privileges could potentially execute arbitrary system commands. Successful exploitation could result in complete device compromise, potentially leading to loss of confidentiality, integrity, and availability. The vulnerability affects the processing of data within the CLI. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Telnet CLI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MyASUS (affected versions not specified) **Description** An insecure sensitive key storage issue was found in MyASUS, potentially allowing an unauthorized actor to obtain a token that could be used to communicate with certain services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MyASUS (affected versions not specified) **Description** An issue involving insecure storage of sensitive keys was identified in MyASUS. This could potentially allow an unauthorized actor to obtain a token used for communication with certain services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ASUS DriverHub versions prior to 1.0.6.0 **Description** The issue resides in the data source validation mechanism within ASUS DriverHub. Insufficient validation allows unauthorized sources to interact with the software's features through crafted HTTP requests. This can lead to remote code execution (RCE). The issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. Attackers can craft malicious domains to facilitate forged HTTP requests processed by DriverHub. **Recommendations** Versions prior to 1.0.6.0 should be updated to version 1.0.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** ASUS DriverHub versions prior to 1.0.6.0 **Description** An insufficient validation issue exists in ASUS DriverHub. This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. The issue may allow untrusted sources to affect system behavior through crafted HTTP requests. The root cause is related to errors in the certificate authentication process. Exploitation of this issue can lead to a denial of service. **Recommendations** Update ASUS DriverHub to version 1.0.6.0 or later.