Pierrekimsec

**Name of the Vulnerable Software and Affected Versions** GNU Inetutils versions through 2.3 MIT krb5-appl versions through 1.0.3 **Description** The issue is related to a NULL pointer dereference in the telnetd application, which can occur via specific byte sequences, such as 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash, but the telnet service would remain available through inetd. However, if the telnetd application experiences many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. **Recommendations** For GNU Inetutils versions through 2.3, consider disabling the telnetd application until a patch is available to prevent potential denial-of-service attacks. For MIT krb5-appl versions through 1.0.3, restrict access to the telnet service to minimize the risk of exploitation, as the affected code was removed from the supported MIT Kerberos 5 product many years ago. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D versions V2.03.57 through V2.03.69 V-SOL V1600D4L version V1.01.49 V-SOL V1600D-MINI version V1.01.48 V-SOL V1600G1 versions V1.9.7 through V2.0.7 V-SOL V1600G2 version V1.1.4 **Description** An issue was discovered in V-SOL OLT devices, where there is a hardcoded password `!j@l#y$z%x6x7q8c9z)` for the admin account to authenticate to the TELNET service. **Recommendations** For V-SOL V1600D versions V2.03.57 through V2.03.69, update the admin account password to a secure one. For V-SOL V1600D4L version V1.01.49, update the admin account password to a secure one. For V-SOL V1600D-MINI version V1.01.48, update the admin account password to a secure one. For V-SOL V1600G1 versions V1.9.7 through V2.0.7, update the admin account password to a secure one. For V-SOL V1600G2 version V1.1.4, update the admin account password to a secure one. As a temporary workaround, consider disabling the TELNET service until a patch is available.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D version 2.03.69 **Description** An issue was discovered on V-SOL V1600D devices, where the string `K0LTdi@gnos312$` is compared to the password provided by the remote attacker. If it matches, access is provided. **Recommendations** For version 2.03.69, consider changing the hardcoded password string `K0LTdi@gnos312$` to a secure, unique password to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D versions V2.03.57 through V2.03.69 V-SOL V1600D4L version V1.01.49 V-SOL V1600D-MINI version V1.01.48 V-SOL V1600G1 versions V1.9.7 through V2.0.7 V-SOL V1600G2 version V1.1.4 **Description** An issue was discovered in V-SOL OLT devices, where a low-privileged (non-admin) attacker can use a hardcoded password to create an admin user. The hardcoded password is 4ef9cea10b2362f15ba4558b1d5c081f. **Recommendations** For V-SOL V1600D versions V2.03.57 through V2.03.69, update the device to remove the hardcoded password. For V-SOL V1600D4L version V1.01.49, update the device to remove the hardcoded password. For V-SOL V1600D-MINI version V1.01.48, update the device to remove the hardcoded password. For V-SOL V1600G1 versions V1.9.7 through V2.0.7, update the device to remove the hardcoded password. For V-SOL V1600G2 version V1.1.4, update the device to remove the hardcoded password. As a temporary workaround, consider restricting access to the device until a patch is available.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D4L version 1.01.49 V-SOL V1600D-MINI version 1.01.48 **Description** An issue was discovered on V-SOL OLT devices, where a hardcoded RSA private key is contained in the firmware images. This key is specific to the V1600D4L and V1600D-MINI devices. **Recommendations** For V-SOL V1600D4L version 1.01.49, consider updating the firmware to remove the hardcoded RSA private key. For V-SOL V1600D-MINI version 1.01.48, consider updating the firmware to remove the hardcoded RSA private key. As a temporary workaround, consider restricting access to the firmware images to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D versions V2.03.57 through V2.03.69 V-SOL V1600G1 versions V1.9.7 through V2.0.7 V-SOL V1600G2 version V1.1.4 **Description** An issue was discovered in V-SOL OLT devices where a hardcoded RSA private key is contained in the firmware images. This key is specific to V1600D, V1600G1, and V1600G2 devices. **Recommendations** For V-SOL V1600D versions V2.03.57 through V2.03.69, consider updating the firmware to remove the hardcoded RSA private key. For V-SOL V1600G1 versions V1.9.7 through V2.0.7, consider updating the firmware to remove the hardcoded RSA private key. For V-SOL V1600G2 version V1.1.4, consider updating the firmware to remove the hardcoded RSA private key. As a temporary workaround, consider restricting access to the firmware images to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D versions V2.03.57 through V2.03.69 V-SOL V1600D4L version V1.01.49 V-SOL V1600D-MINI version V1.01.48 V-SOL V1600G1 versions V1.9.7 through V2.0.7 V-SOL V1600G2 version V1.1.4 **Description** An issue was discovered in V-SOL OLT devices, where command injection can occur via a crafted filename in the CLI, specifically in the "upload tftp syslog" and "upload tftp configuration" commands. **Recommendations** For V-SOL V1600D versions V2.03.57 through V2.03.69, consider disabling the "upload tftp syslog" and "upload tftp configuration" commands in the CLI until a patch is available. For V-SOL V1600D4L version V1.01.49, restrict access to the CLI to minimize the risk of exploitation. For V-SOL V1600D-MINI version V1.01.48, avoid using crafted filenames in the "upload tftp syslog" and "upload tftp configuration" commands. For V-SOL V1600G1 versions V1.9.7 through V2.0.7, consider implementing additional security measures to prevent command injection attacks. For V-SOL V1600G2 version V1.1.4, restrict access to the vulnerable commands in the CLI to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D versions V2.03.57 through V2.03.69 V-SOL V1600D4L version V1.01.49 V-SOL V1600D-MINI version V1.01.48 V-SOL V1600G1 versions V1.9.7 through V2.0.7 V-SOL V1600G2 version V1.1.4 **Description** An issue was discovered in the V-SOL OLT devices where TELNET is offered by default, but SSH is not always available. This allows an attacker to intercept passwords sent in cleartext and conduct a man-in-the-middle attack on the management of the appliance. **Recommendations** For V-SOL V1600D versions V2.03.57 through V2.03.69, consider disabling the TELNET service and enabling SSH to encrypt management communications. For V-SOL V1600D4L version V1.01.49, restrict access to the management interface to minimize the risk of exploitation. For V-SOL V1600D-MINI version V1.01.48, avoid using the TELNET protocol for management until a secure alternative is available. For V-SOL V1600G1 versions V1.9.7 through V2.0.7, configure the device to use SSH instead of TELNET for secure management. For V-SOL V1600G2 version V1.1.4, limit access to the management interface to trusted sources only.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D4L version 1.01.49 V-SOL V1600D-MINI version 1.01.48 **Description** An issue was discovered on V-SOL OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access. **Recommendations** For V-SOL V1600D4L version 1.01.49, consider disabling the telnetd process until a patch is available. For V-SOL V1600D-MINI version 1.01.48, restrict access to the update script to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** V-SOL V1600D versions V2.03.57 through V2.03.69 V-SOL V1600D4L version V1.01.49 V-SOL V1600D-MINI version V1.01.48 V-SOL V1600G1 versions V1.9.7 through V2.0.7 V-SOL V1600G2 version V1.1.4 **Description** An issue was discovered in V-SOL OLT devices, allowing the elevation of privilege of a CLI user to full administrative access by using a specific password for the enable command. The password `!j@l#y$z%x6x7q8c9z)` can be used to gain full administrative access. **Recommendations** For V-SOL V1600D versions V2.03.57 through V2.03.69, update the password for the enable command to prevent unauthorized access. For V-SOL V1600D4L version V1.01.49, change the default password for the enable command. For V-SOL V1600D-MINI version V1.01.48, restrict access to the enable command until a patch is available. For V-SOL V1600G1 versions V1.9.7 through V2.0.7, consider disabling the enable command temporarily. For V-SOL V1600G2 version V1.1.4, avoid using the default password for the enable command.

Name of the Vulnerable Software and Affected Versions: TOTOLINK A850R-V1 versions 1.0.1-B20150707.1612 and earlier TOTOLINK F1-V2 versions 1.1-B20150708.1646 and earlier Description: An issue was discovered in the management interface of the affected devices, allowing Remote Code Execution via the `sysCmd` parameter in the `formSysCmd` interface. Recommendations: For TOTOLINK A850R-V1 versions 1.0.1-B20150707.1612 and earlier, consider disabling the `formSysCmd` interface until a patch is available. For TOTOLINK F1-V2 versions 1.1-B20150708.1646 and earlier, restrict access to the management interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TOTOLINK A850R-V1 versions 1.0.1-B20150707.1612 and earlier TOTOLINK F1-V2 versions 1.1-B20150708.1646 and earlier Description: An issue allows the web management interface to be opened on the WAN interface by sending a specific `hel,xasf` packet. Recommendations: For TOTOLINK A850R-V1 versions 1.0.1-B20150707.1612 and earlier, restrict access to the WAN interface to prevent exploitation. For TOTOLINK F1-V2 versions 1.1-B20150708.1646 and earlier, consider disabling the web management interface on the WAN interface until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue concerns a world-readable file that stores hardcoded credentials. The file in question is `xmpp config.py`, located at `axess/opt/axXMPPHandler/config/`. This poses a significant security risk as it potentially exposes sensitive information. **Recommendations** For versions 3.1.0 and 3.1.1, consider restricting access to the `xmpp config.py` file to prevent unauthorized reading of the hardcoded credentials. As a temporary workaround, changing the file permissions to limit access can help mitigate the risk until a more permanent solution is available.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue concerns a hardcoded DSA SSH key for the root account, which could potentially allow unauthorized access. **Recommendations** For versions 3.1.0 and 3.1.1, consider changing the root account password and regenerating SSH keys to prevent unauthorized access. As a temporary workaround, restrict SSH access to the root account until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue concerns a lack of authentication for "/cnr" requests. This means that the "/cnr" API endpoint does not require authentication, potentially allowing unauthorized access. **Recommendations** For versions 3.1.0 and 3.1.1, consider restricting access to the "/cnr" API endpoint until a fix is available. As a temporary workaround, avoid using the "/cnr" requests in the affected Zyxel CloudCNM SecuManager versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue allows escape-sequence injection into the /var/log/axxmpp.log file. This is related to the API endpoint /var/log/axxmpp.log, but specific vulnerable parameters or variables are not mentioned. **Recommendations** For versions 3.1.0 and 3.1.1, consider restricting access to the log file to minimize the risk of exploitation. As a temporary workaround, avoid using the logging functionality related to the /var/log/axxmpp.log file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue concerns a XSS vulnerability. It affects the `handle campaign script link` endpoint, specifically the `script name` parameter. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For versions 3.1.0 and 3.1.1, consider restricting access to the `live/CPEManager/AXCampaignManager/handle campaign script link` endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `script name` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue concerns an unauthenticated API, specifically the "zy install user key" API endpoint. This allows for unauthorized access. **Recommendations** For versions 3.1.0 and 3.1.1, consider disabling the `zy install user key` API endpoint until a patch is available. Restrict access to the `zy install user key` API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue concerns a /live/GLOBALS API endpoint with the `CLOUDCNM` key. **Recommendations** For versions 3.1.0 and 3.1.1, consider restricting access to the /live/GLOBALS API endpoint as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 **Description** The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices on the network. The `axiros` account has a hardcoded password `q6xV4aW8bQ4cfD-b`. **Recommendations** For Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1, consider changing the password for the `axiros` account to prevent unauthorized access. As a temporary workaround, restrict access to the `axiros` account until a patch is available. Avoid using the default password `q6xV4aW8bQ4cfD-b` for the `axiros` account in the affected software.