Nixawk

A remote code execution issue exists due to an undocumented backdoor listener on UDP port 53413. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. The backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.

The issue exists due to insufficient validation of user-input data that is part of a message, allowing a remote attacker to execute arbitrary code. This can be achieved by passing a malicious field value in a raw message to the ActionMessage.

The issue is related to errors in handling .LNK files, which can allow local users or remote attackers to execute arbitrary code. This can occur when a crafted .LNK file is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. Exploitation of this issue may enable an attacker to execute arbitrary code by connecting to a system with a specially crafted shortcut associated with a malicious application. After viewing the storage device using any application that performs icon parsing, arbitrary code will be executed.

The issue allows remote attackers to execute arbitrary code via vectors related to an `!` (exclamation mark) operator to the REST Plugin when Dynamic Method Invocation is enabled.

The issue is related to the implementation of the Dynamic Method Invocation (DMI) mechanism in Apache Struts, which fails to properly sanitize input data. This allows a remote attacker to execute arbitrary code using the `method:` prefix, related to chained expressions.