Pagvac

In streams mode, the management HTTP API is exposed on `0.0.0.0:4195` without authentication enabled by default, leaving stream CRUD routes unprotected. An unauthenticated attacker with network access to TCP/4195 can send a `POST` request to the `/streams/{id}` endpoint with a malicious pipeline definition. By utilizing code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql raw`, the attacker can achieve arbitrary remote code execution (RCE) on the host with the permissions of the service account. This allows for full host compromise, credential theft, and data exfiltration, as pipelines can return command output in-band via HTTP.

A cross-site request forgery (CSRF) issue exists in the web interface, allowing remote attackers to hijack the authentication of administrators for requests that change settings.

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera version 1.00R22 Cisco Linksys WVC54GCA wireless video camera version 1.00R24 Description: The issue allows remote attackers to obtain sensitive information, such as passwords, by reading the process memory of the SetupWizard.exe. This is related to the way the camera sends configuration data in response to a remote-management command from the Setup Wizard. Recommendations: For version 1.00R22, update the firmware to a version that addresses this issue. For version 1.00R24, update the firmware to a version that addresses this issue. As a temporary workaround, consider restricting access to the Setup Wizard remote-management command until a patch is available.

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera firmware 1.00R22 Cisco Linksys WVC54GCA wireless video camera firmware 1.00R24 Description: The issue allows remote authenticated users to read arbitrary files in the img/ directory via a filename in the `next file` parameter. This can be exploited to read sensitive files, such as .htpasswd, to obtain the admin password. Recommendations: For firmware 1.00R22, avoid using the `next file` parameter in the img/main.cgi endpoint until the issue is resolved. For firmware 1.00R24, restrict access to the img/ directory to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the img/main.cgi endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera version 1.00R22 Cisco Linksys WVC54GCA wireless video camera version 1.00R24 Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the `next file` parameter to API endpoints such as "main.cgi", "img/main.cgi", or "adm/file.cgi", or the `this file` parameter to the "adm/file.cgi" endpoint. Recommendations: For version 1.00R22, avoid using the `next file` parameter in the "main.cgi", "img/main.cgi", and "adm/file.cgi" API endpoints, and the `this file` parameter in the "adm/file.cgi" endpoint until a patch is available. For version 1.00R24, avoid using the `next file` parameter in the "main.cgi", "img/main.cgi", and "adm/file.cgi" API endpoints, and the `this file` parameter in the "adm/file.cgi" endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera versions 1.00R22 through 1.00R24 Description: The issue allows remote attackers to read arbitrary files via a %2e (encoded dot dot) or an absolute pathname in the `next file` parameter of the adm/file.cgi file. Recommendations: For versions 1.00R22 and 1.00R24, avoid using the `next file` parameter in the adm/file.cgi file until a fix is available. Restrict access to the adm/file.cgi file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera version 1.00R24 Cisco Linksys WVC54GCA wireless video camera version 1.00R22 Description: The issue allows remote attackers to read arbitrary files via an absolute pathname in the `this file` parameter. It is likely that traversal via a .. (dot dot) is also possible. Recommendations: For version 1.00R24, avoid using the `this file` parameter with absolute pathnames in the adm/file.cgi endpoint until a fix is available. For version 1.00R22, avoid using the `this file` parameter with absolute pathnames in the adm/file.cgi endpoint until a fix is available. As a temporary workaround, consider restricting access to the adm/file.cgi endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera versions 1.00R22 through 1.00R24 Description: The issue concerns the storage of sensitive information in cleartext. Specifically, passwords and wireless-network keys are stored in cleartext in `pass wd.htm` and `Wsecurity.htm`. This allows remote attackers to obtain sensitive information by reading the HTML source code. Recommendations: For versions 1.00R22 and 1.00R24, consider restricting access to the `pass wd.htm` and `Wsecurity.htm` files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows local users, and possibly remote attackers, to cause a denial of service by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be performed remotely.

The issue allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering. This occurs because the content filtering system's block page does not properly handle the input, leading to a cross-site scripting (XSS) vulnerability. This can be used for "universal website hijacking."

The issue allows remote attackers to bypass authentication and access administrative settings on the BT Home Hub router. This can be achieved by appending specific characters to the end of the PATH INFO, such as `%5C` (encoded backslash), `%` (percent), or `~` (tilde). This enables attackers to read or modify administrative settings or make arbitrary VoIP telephone calls.

A cross-site scripting (XSS) issue exists in the session.cgi (login page) that allows remote attackers to inject arbitrary web script or HTML via the query string. This can be leveraged to capture login credentials in some browsers that support remembered (auto-completed) passwords.

The issue concerns the admin web console, which does not require passwords or authentication tokens when using HTTP. This allows remote attackers to connect to existing superuser sessions, potentially obtaining sensitive information such as passwords and configuration data.

The issue allows remote attackers to bypass the authentication process and gain sensitive information. This can include configuration information via the "/btvoyager getconfig.sh" endpoint, PPP credentials via the "btvoyager getpppcreds.sh" endpoint, and decoding configuration credentials via the "btvoyager decoder.c" file.

The issue is related to the improper setting of an administrative password, allowing remote attackers to gain access to the device. This can be done via the Telnet or web administration interfaces, specifically through endpoints such as the Telnet interface or the web administration interface.