Pedrib1337

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 17.1 iPadOS versions prior to 17.1 watchOS versions prior to 10.1 iOS versions prior to 16.7.2 iPadOS versions prior to 16.7.2 macOS Sonoma versions prior to 14.1 Safari versions prior to 17.1 tvOS versions prior to 17.1 **Description** A logic issue was addressed with improved checks. Processing web content may lead to arbitrary code execution. The issue is related to insufficient input validation in the WebKit browser's web page display modules. Exploitation of the issue may allow a remote attacker to execute arbitrary code. **Recommendations** For iOS versions prior to 17.1, update to iOS 17.1 or later. For iPadOS versions prior to 17.1, update to iPadOS 17.1 or later. For watchOS versions prior to 10.1, update to watchOS 10.1 or later. For iOS versions prior to 16.7.2, update to iOS 16.7.2 or later. For iPadOS versions prior to 16.7.2, update to iPadOS 16.7.2 or later. For macOS Sonoma versions prior to 14.1, update to macOS Sonoma 14.1 or later. For Safari versions prior to 17.1, update to Safari 17.1 or later. For tvOS versions prior to 17.1, update to tvOS 17.1 or later.

**Name of the Vulnerable Software and Affected Versions** ManageEngine ADSelfService Plus (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this issue. The specific flaw exists within the Password Reset Portal used by the GINA client, resulting from the lack of proper authentication of data received via HTTP. An attacker can leverage this issue to bypass authentication and execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000) **Description** This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of APP files, specifically due to the process loading a library from an unsecured location. An attacker can leverage this to execute code in the context of the current process. **Recommendations** For AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000), consider restricting access to unsecured locations where libraries are loaded to minimize the risk of exploitation. As a temporary workaround, avoid handling APP files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Small Business RV Series Routers versions RV160, RV260, RV340, and RV345 **Description** The issue is caused by a stack-based buffer overflow in the SSL VPN module of the Cisco Small Business RV340, RV340W, RV345, and RV345P routers. This can be exploited by a remote attacker using a specially crafted HTTP request, allowing them to execute arbitrary code with root privileges. The vulnerability can also lead to elevation of privileges, execution of arbitrary commands, bypassing of authentication and authorization protections, fetching and running unsigned software, and denial of service (DoS). **Recommendations** For Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers, update to a fixed version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link TL-WA1201 version 1.0.1 Build 20200709 rel.66244(5553) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 wireless access points. Authentication is not required to exploit this issue. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** For TP-Link TL-WA1201 version 1.0.1 Build 20200709 rel.66244(5553), as a temporary workaround, consider disabling the handling of DNS responses until a patch is available. Restrict access to the DNS handling module to minimize the risk of exploitation. Avoid using crafted DNS messages in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer C90 version 1.0.6 Build 20200114 rel.73164(5553) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 routers. Authentication is not required to exploit this issue. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** For TP-Link Archer C90 version 1.0.6 Build 20200114 rel.73164(5553), as a temporary workaround, consider restricting access to the DNS response handling mechanism until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Arlo Q Plus version 1.9.0.3 278 **Description** This issue allows attackers with physical access to escalate privileges on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the SSH service, where the device can be booted into a special operation mode and hard-coded credentials are accepted for SSH authentication. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of root. **Recommendations** For Arlo Q Plus version 1.9.0.3 278, as a temporary workaround, consider disabling the SSH service until a patch is available. Restrict physical access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: NETGEAR R7800 firmware version 1.0.2.76 Description: This issue allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the downloading of files via FTP, resulting from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of root. Recommendations: For NETGEAR R7800 firmware version 1.0.2.76, consider disabling FTP file downloads until a patch is available to prevent exploitation. Restrict access to the FTP service to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: TP-Link Archer A7 versions prior to Archer C7(US) V5 210125 and Archer A7(US) V5 200220 Description: This issue allows for a firewall bypass on affected installations. It does not require authentication to exploit. The flaw exists within the handling of IPv6 connections, specifically due to the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this, potentially in conjunction with other issues, to execute code in the context of root. Recommendations: For TP-Link Archer A7 versions prior to Archer C7(US) V5 210125 and Archer A7(US) V5 200220, update to a version that includes the necessary security patches to address the firewall bypass issue. As a temporary workaround, consider restricting IPv6 SSH connections to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk R7800 (affected versions not specified) Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within handling of firmware updates, resulting from a fallback to an insecure protocol to deliver updates. An attacker can leverage this issue to execute code in the context of root. Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** tdpServer on TP-Link Archer A7 AC1750 devices before 201029 **Description** The issue allows remote attackers to execute arbitrary code via the `slave mac` parameter. This is due to an incomplete fix for a previous issue, where shell quotes are mishandled. **Recommendations** For versions before 201029, update to version 201029 or later to resolve the issue. As a temporary workaround, consider restricting access to the `slave mac` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Operation Bridge Manager versions 10.10 through 2020.05 Operations Bridge (containerized) versions 2017.11 through 2020.05 **Description** The issue affects Micro Focus products, allowing local attackers to execute code with escalated privileges. This could enable attackers to perform actions with higher privileges than intended. **Recommendations** For Operation Bridge Manager versions 10.10 through 2020.05, update to a version later than 2020.05 to resolve the issue. For Operations Bridge (containerized) versions 2017.11 through 2020.05, update to a version later than 2020.05 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Operation Bridge Manager versions 2017.11 through 2020.05 Operations Bridge (containerized) versions 2017.11 through 2020.05 Application Performance Management versions 9.40 through 9.51 **Description** The issue affects Micro Focus products, including Operation Bridge Manager, Operations Bridge (containerized), and Application Performance Management. It could allow arbitrary code execution. **Recommendations** For Operation Bridge Manager versions 2017.11 through 2020.05, update to a version later than 2020.05. For Operations Bridge (containerized) versions 2017.11 through 2020.05, update to a version later than 2020.05. For Application Performance Management versions 9.40 through 9.51, update to a version later than 9.51.

**Name of the Vulnerable Software and Affected Versions** Micro Focus Operation Bridge Reporter version 10.40 **Description** The issue is related to a Remote Code Execution vulnerability in the Micro Focus Operation Bridge Reporter product. It could be exploited to allow Remote Code Execution on the OBR server. The vulnerability is associated with incorrect handling of parameters in the `LogonResource` endpoint. This could enable a remote attacker to execute arbitrary code. **Recommendations** For version 10.40, consider disabling the `LogonResource` endpoint or restricting access to it until a patch is available. Additionally, be cautious when using the `userName` and token parameters in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Micro Focus Operation Bridge Reporter versions 10.40 and earlier **Description** The issue is related to an Authorization Bypass, which could allow remote attackers to access the OBR host as a non-admin user. Additionally, there is a mention of a remote code execution vulnerability due to the use of hard-coded credentials. **Recommendations** For versions 10.40 and earlier, update to a version later than 10.40 to resolve the issue. As a temporary workaround, consider restricting access to the OBR host to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Micro Focus Operation Bridge Reporter versions 10.40 and earlier **Description** The issue is related to arbitrary code execution, which could allow remote attackers to execute arbitrary code on affected installations. This is due to a missing authentication vulnerability in the JMX interface. **Recommendations** For versions 10.40 and earlier, update to a version later than 10.40 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Micro Focus Operation Bridge Reporter versions 10.40 and earlier **Description** The issue is related to an Authorization Bypass, which could allow local attackers on the host to execute code with escalated privileges. This is due to an incorrect permission assignment. **Recommendations** For versions 10.40 and earlier, update to a version later than 10.40 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NETGEAR R6700 version 1.0.4.84 10.0.58 **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `acsd` service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of the admin user. **Recommendations** For NETGEAR R6700 version 1.0.4.84 10.0.58, as a temporary workaround, consider disabling the `acsd` service until a patch is available. Restrict access to TCP port 5916 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84 10.0.58 **Description** This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `check ra` service. A crafted `raePolicyVersion` in a `RAE Policy.json` file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** For NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84 10.0.58, consider disabling the `check ra` service until a patch is available. Restrict access to the `RAE Policy.json` file to minimize the risk of exploitation. Avoid using crafted `raePolicyVersion` values in the `RAE Policy.json` file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Apache Flex BlazeDS versions 4.7.2 and earlier **Description** The issue is related to the deserialization process in Apache Flex BlazeDS, where code is executed that can have undesired side-effects for several known types. This can potentially allow an attacker to trigger further exploitable Java deserialization of untrusted data, and in some cases, remote code execution. The vulnerability may be exploited by a remote attacker to execute arbitrary code when deserializing an untrusted Java object. **Recommendations** For Apache Flex BlazeDS versions 4.7.2 and earlier, consider restricting the types allowed for AMF(X) object deserialization to prevent potential exploitation. As a temporary workaround, consider disabling the deserialization of untrusted data until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.