Olivier Laflamme

**Name of the Vulnerable Software and Affected Versions** Unitree G1 EDU firmware versions prior to 1.5.3 **Description** Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials. This is possible by exploiting a buffer overflow in the SSID chunk accumulator and an unquoted heredoc variable in the WiFi provisioning script. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, which corrupts an adjacent mainloop function pointer dispatch entry. This entry is later invoked by the cleanup path, passing attacker-controlled data to the `system()` function as uid 0. **Recommendations** Update Unitree G1 EDU firmware to a version newer than 1.5.2.

**Name of the Vulnerable Software and Affected Versions** Unitree G1 EDU firmware versions prior to 1.5.3 **Description** An unauthenticated remote code execution flaw allows network-adjacent attackers to execute arbitrary commands as root. This is achieved by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the `chat go` knowledge upload API. Attackers can publish DDS control messages to restart the `bashrunner` service, use path traversal to place a malicious payload in the script execution directory, and trigger the execution of that payload as uid 0 through the `bashrunner` shell subprocess. **Recommendations** Update Unitree G1 EDU firmware to a version newer than 1.5.2. Restrict access to TCP port 9991 to minimize the risk of exploitation. Avoid using the `chat go` knowledge upload API until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** llama.cpp versions prior to b8585 **Description** A use-after-free issue exists in the RPC server's `GRAPH RECOMPUTE` handler. This occurs when a computation graph is stored and its referenced buffers are subsequently freed, allowing the freed memory to be reclaimed with attacker-controlled content. Unauthenticated remote attackers can trigger the re-execution of these stored graphs using dangling pointers—pointers that still reference memory locations after they have been freed—to achieve arbitrary read and write access, potentially leading to full remote code execution without user interaction. **Recommendations** Update llama.cpp to version b8585 or later.

**Name of the Vulnerable Software and Affected Versions** Unitree Go2 versions 1.1.7 through 1.1.11 **Description** Remote code execution is possible when using the Unitree Go2 Android application (com.unitree.doggo2) due to a lack of integrity protection and validation for user-created programs. The Android application stores programs in a local SQLite database (`unitree go2.db`, table `dog programme`) and transmits the `programme text` content, specifically the `pyCode` field, to the robot. The robot's `actuator manager.py` function executes the received Python code as root without verifying its integrity or validating the content. An attacker with local access to the Android device can modify the stored program record to inject arbitrary Python code, which is then executed when the user triggers the program via a controller keybinding; this malicious binding persists after reboots. Furthermore, importing and running a malicious program shared through the application's community marketplace can lead to arbitrary code execution on the robot. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Unitree Go2 versions V1.1.7 through V1.1.9 Unitree Go2 version V1.1.11 (EDU) **Description** Lack of DDS authentication and authorization for the Eclipse CycloneDDS topic 'rt/api/programming actuator/request' handled by `actuator manager.py` allows a network-adjacent, unauthenticated attacker to join DDS domain 0. By publishing a crafted message using the `api id` variable set to 1002, the attacker can send arbitrary Python code. The robot writes this code to the disk at /unitree/etc/programming/ and binds it to a physical controller keybinding. When the keybinding is triggered, the code executes with root privileges, and the binding remains active after reboots. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router version V15.11.0.10(1576) **Description** The issue is related to a command injection vulnerability in the function formSetFixTools, allowing attackers to run arbitrary commands on the server via the `hostname` parameter. **Recommendations** For Tenda AC1200 Router version V15.11.0.10(1576), as a temporary workaround, consider restricting access to the `formSetFixTools` function until a patch is available. Avoid using the `hostname` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576) **Description** The issue is related to a command injection vulnerability. This vulnerability can be exploited via the `dmzHost` parameter in the `setDMZ` function. **Recommendations** For Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576), as a temporary workaround, consider restricting access to the `setDMZ` function until a patch is available. Avoid using the `dmzHost` parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576) **Description** The issue concerns multiple command injection vulnerabilities found in the function setIPsecTunnelList. These vulnerabilities can be exploited via the `IPsecLocalNet` and `IPsecRemoteNet` parameters. **Recommendations** For Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576), as a temporary workaround, consider restricting access to the `setIPsecTunnelList` function until a patch is available. Avoid using the `IPsecLocalNet` and `IPsecRemoteNet` parameters in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576) **Description** The issue is related to a stack overflow via the `setRemoteWebManage` function, allowing attackers to cause a Denial of Service (DoS) via crafted overflow data. **Recommendations** For Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576), as a temporary workaround, consider disabling the `setRemoteWebManage` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router Model W15Ev2 version 15.11.0.10(1576) **Description** The issue is related to a stack overflow via the `setWanPpoe` function, allowing attackers to cause a Denial of Service (DoS) by sending crafted overflow data. **Recommendations** For Tenda AC1200 Router Model W15Ev2 version 15.11.0.10(1576), consider disabling the `setWanPpoe` function as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576) **Description** A command injection issue was discovered via the `PortMappingServer` parameter in the `setPortMapping` function. This allows for potential exploitation. **Recommendations** For Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576), as a temporary workaround, consider restricting access to the `setPortMapping` function until a patch is available. Avoid using the `PortMappingServer` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 V-W15Ev2 version V15.11.0.10(1576) **Description** The issue concerns improper authorization and improper session management, allowing the router login page to be bypassed. This enables authenticated attackers to read the router's syslog.log file, which contains the MD5 password of the Administrator's user account. **Recommendations** For version V15.11.0.10(1576), consider restricting access to the syslog.log file to prevent unauthorized reading of the Administrator's password. As a temporary workaround, restrict access to the router's login page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router model W15Ev2 version V15.11.0.10(1576) **Description** A Stored Cross Site Scripting (XSS) issue exists, allowing an attacker to execute JavaScript code via the application's website filtering tab, specifically the URL body. **Recommendations** For Tenda AC1200 Router model W15Ev2 version V15.11.0.10(1576), as a temporary workaround, consider restricting access to the website filtering tab until a patch is available. Avoid using the URL body in the affected tab to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router model W15Ev2 version V15.11.0.10(1576) **Description** The issue allows an attacker with access to the router to expose sensitive information they are not explicitly authorized to have, by combining a password exposure vulnerability with improper authorization and improper session management vulnerabilities. **Recommendations** For Tenda AC1200 Router model W15Ev2 version V15.11.0.10(1576), consider restricting access to the router and sensitive information until a patch or fix is available. As a temporary workaround, limit the use of features that may be affected by the improper authorization and session management vulnerabilities. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC1200 Router version 15.11.0.10(1576) **Description** A Stored Cross Site Scripting (XSS) issue exists, allowing an attacker to execute JavaScript code via the application's stored hostname. This enables the attacker to potentially manipulate the application's behavior or steal sensitive information. **Recommendations** For Tenda AC1200 Router version 15.11.0.10(1576), consider restricting access to the hostname storage functionality until a patch is available. As a temporary workaround, avoid using the stored hostname feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00 **Description** The issue concerns command injection vulnerabilities in the ping and traceroute tools of the system, allowing attackers to read arbitrary files on the system. **Recommendations** For version 1.00.220412.00, consider restricting access to the ping and traceroute tools until a patch is available. As a temporary workaround, avoid using these tools to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00 **Description** The issue concerns multiple stored cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Company Name` and `Description` text fields. **Recommendations** For GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00, as a temporary workaround, consider restricting user input for the `Company Name` and `Description` fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gl-inet GL-MT300N-V2 Mango version 3.212 gl-inet GL-AX1800 Flint version 3.214 **Description** The issue concerns command injection vulnerabilities. These vulnerabilities can be exploited via the `ping addr` and `trace addr` function parameters. **Recommendations** For gl-inet GL-MT300N-V2 Mango version 3.212, avoid using the `ping addr` and `trace addr` function parameters until a fix is available. For gl-inet GL-AX1800 Flint version 3.214, restrict access to the `ping addr` and `trace addr` function parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM FileNet Content Manager and IBM Content Navigator version 3.0.CD **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For version 3.0.CD, at the moment, there is no information about a newer version that contains a fix for this vulnerability.