Ricky Lawshae

This issue allows physically present attackers to execute arbitrary code on affected installations of the Visteon Infotainment system. Authentication is not required to exploit this issue. The specific flaw exists within the DeviceManager, where the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of root.

This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the handling of authentication headers, specifically due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of root.

This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this issue. The flaw exists within the handling of the `ping` parameter provided to `tools.sh`, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root.

The issue allows remote attackers to bypass authentication due to improper password validation.

The issue allows remote attackers to obtain credentials by reading the configuration files. This is related to the management portal in the affected device.

The issue is related to a cross-site scripting (XSS) vulnerability, specifically a persistent cross-site scripting vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in the s network.asp file, which is related to the 'Friendlyname' feature.

The issue is related to the miniigd SOAP service in Realtek SDK, which allows remote attackers to execute arbitrary code via a crafted NewInternalClient request. This has been exploited in the wild through 2023. The vulnerability is associated with insufficient input validation, allowing an attacker to execute arbitrary code using specially formed requests.