Paul Marrapese

**Name of the Vulnerable Software and Affected Versions** CS2 Network P2P versions 2.x through 3.x **Description** The issue allows remote attackers to perform a man-in-the-middle attack, enabling them to eavesdrop on user video/audio streams, capture credentials, and compromise devices. This affects millions of Internet of Things devices. **Recommendations** For versions 2.x through 3.x, as a temporary workaround, consider restricting access to sensitive data and disabling any features that rely on the vulnerable authentication mechanism until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CS2 Network P2P versions 2.x through 3.x **Description** The issue affects millions of Internet of Things devices, causing an information exposure flaw that compromises user session data. This is done by exposing data to supernodes in the network. As a result, it is possible to passively eavesdrop on user video/audio streams, capture credentials, and compromise devices. **Recommendations** For versions 2.x through 3.x, consider restricting access to the supernodes in the network to minimize the risk of exploitation. Avoid using sensitive information over the affected network until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shenzhen Yunni Technology iLnkP2P (affected versions not specified) **Description** The algorithm used to generate device IDs (UIDs) for devices that utilize iLnkP2P suffers from a predictability flaw, allowing remote attackers to establish direct connections to arbitrary devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shenzhen Yunni Technology iLnkP2P (affected versions not specified) **Description** The issue is related to an authentication flaw that allows remote attackers to intercept user-to-device traffic in cleartext. This includes video streams and device credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.