Quentin Kaiser

The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges.

The issue concerns the exposure of a web interface in the Diviotec professional series, where one endpoint is vulnerable to arbitrary command injection. Additionally, hardcoded passwords are used, which poses a security risk.

An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the modem, could manipulate specific responses to include code that forces a buffer overflow on the modem. This issue is only exploitable on devices with Dynamic DNS enabled. Customers that have not enabled Dynamic DNS on their modem are not vulnerable.

The device exposes a web interface on ports TCP/3030 and TCP/9882, running lighttpd, which implements the “SNORE” interface. This interface is affected by a stack buffer overflow vulnerability due to insecure path parsing. An attacker with access to the LAN network interface could use a specially crafted HTTP request to exploit a buffer overflow on the modem. The vulnerability can lead to remote code execution and denial of service.

The Meteobridge web interface is susceptible to a command injection flaw. This allows remote, unauthenticated attackers to execute arbitrary commands with elevated privileges (root) on affected devices. The vulnerability resides in the web interface and specifically impacts the handling of input in the `/public/template.cgi` endpoint. Approximately 100 devices are reportedly exposed to the internet. CISA has flagged this vulnerability (CVE-2025-4008) as actively exploited in the wild. The vulnerability stems from insecure CGI script handling.

The issue affects devices that communicate with the eCharge cloud infrastructure over an insecure channel, as peer verification is disabled. This allows remote unauthenticated users, suitably positioned on the network between an EV charger controller and eCharge infrastructure, to execute arbitrary commands with elevated privileges on affected devices.

The issue affects the cph2 echarge firmware, allowing OS Command Injection due to an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.

Name of the Vulnerable Software and Affected Versions: TP-Link Archer C5400X versions prior to 1.1.7 TP-Link Archer C4500X versions through 1 1.1.6 Description: The issue is related to a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. This allows a remote unauthenticated attacker to gain arbitrary command execution on the device with elevated privileges. The problem is associated with the rftest binary file, which opens a network listener on TCP ports. Recommendations: For TP-Link Archer C5400X versions prior to 1.1.7, update to version 1.1.7 or later, which fixes the vulnerability by preventing the execution of commands with shell symbols. For TP-Link Archer C4500X versions through 1 1.1.6, consider disabling the "rftest" service as a temporary workaround until a patch is available. Restrict access to the vulnerable TCP ports (8888, 8889, and 8890) to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Ligowave UNITY versions through 6.95-2 Ligowave PRO versions through 6.95-1.Rt3883 Ligowave MIMO versions through 6.95-1.Rt2880 Ligowave APC Propeller versions through 2-5.95-4.Rt3352 Description: A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges. Recommendations: For Ligowave UNITY versions through 6.95-2, update to a version later than 6.95-2 to resolve the issue. For Ligowave PRO versions through 6.95-1.Rt3883, update to a version later than 6.95-1.Rt3883 to resolve the issue. For Ligowave MIMO versions through 6.95-1.Rt2880, update to a version later than 6.95-1.Rt2880 to resolve the issue. For Ligowave APC Propeller versions through 2-5.95-4.Rt3352, update to a version later than 2-5.95-4.Rt3352 to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users, which implements features affected by command injections and stack overflows. Successful exploitation of these flaws would allow remote attackers to gain remote code execution with elevated privileges on the affected devices. The interface's features, such as access control lists management and WPS pin setup, are vulnerable to these attacks.

The issue exists due to insufficient validation of user-supplied input in the web-based management interface, allowing an authenticated, remote attacker to perform command injection attacks. To exploit this, the attacker must have valid administrative credentials for the device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system by sending a crafted HTTP request to the web-based management interface.

The issue is related to a buffer overflow vulnerability in the web-based user interface of the affected devices. This vulnerability can be exploited by an authenticated, remote attacker who has valid administrative credentials for the device. The attacker can send a crafted HTTP request to the web-based management interface, potentially allowing them to execute arbitrary code as the root user on the underlying operating system. The vulnerability is due to insufficient validation of user-supplied input.

A vulnerability in WAGO products allows an unauthenticated, remote attacker to create new users and change the device configuration, which can result in unintended behavior, Denial of Service, and full system compromise. The issue is related to insufficient input validation, which can allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. Approximately 15,961 devices may be affected.

The NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges.

The NetModule NSRW web administration interface is susceptible to path traversal attacks. This could allow authenticated users to upload arbitrary files to the web root directory, potentially leading to remote command execution with elevated privileges.

A path traversal issue affects the yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.

A path traversal issue affects jefferson's JFFS2 filesystem extractor. Attackers can craft malicious JFFS2 files to force jefferson to write outside of the extraction directory.

The issue is related to path traversal when running against specifically crafted UBIFS files, allowing an attacker to overwrite files outside of the extraction directory if the process has write access. This occurs because a node name (`dent node.name`) is considered trusted and joined to the extraction directory path during processing, and then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g., ../../tmp/outside.txt), it's possible to force the software to write outside of the extraction directory.

binwalk is susceptible to a path traversal vulnerability. An attacker can exploit this by crafting a malicious PFS filesystem file, which allows them to extract files to arbitrary locations when binwalk is run in extraction mode (using the -e option). This can lead to remote code execution by extracting a malicious binwalk module into the `.config/binwalk/plugins` folder. The vulnerability is associated with the `src/binwalk/plugins/unpfs.py` file.

The issue allows a remote unauthenticated attacker to download a backup file, if one exists. This backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successful.