Ncc Group

**Name of the Vulnerable Software and Affected Versions** HPE Aruba Networking EdgeConnect SD-WAN Gateways (affected versions not specified) **Description** A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could disrupt system operations, potentially resulting in an unstable system state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EdgeConnect SD-WAN (affected versions not specified) **Description** A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EdgeConnect SD-WAN ECOS (affected versions not specified) **Description** A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. This could lead to exposure and exfiltration of sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Aruba Networking EdgeConnect SD-WAN Gateways (affected versions not specified) **Description** A flaw exists in the cryptographic logic of the software that may allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access and control over the affected systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EdgeConnect SD-WAN (affected versions not specified) **Description** A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Phoenix Contact CHARX SEC-3000 versions up to 1.6.2 **Description** A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user `user-app` to the default password. The issue is related to insecure default resource initialization. **Recommendations** For Phoenix Contact CHARX SEC-3000 versions up to 1.6.2, update the firmware to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the firmware update feature on the LAN interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dell Integrated Remote Access Controller 8 (iDRAC8) (affected versions not specified) **Description** A command injection vulnerability exists in local RACADM, which is related to incorrect input validation. This issue can be exploited by a malicious authenticated user to gain control of the underlying operating system. The vulnerability allows a remote attacker to potentially take control of the system. **Recommendations** As a temporary workaround, consider disabling the local RACADM until a patch is available. Restrict access to the local RACADM to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.