Sam Quinn

**Name of the Vulnerable Software and Affected Versions** Dataprobe iBoot PDU versions 1.43.03312023 or earlier **Description** The issue concerns command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this to execute arbitrary commands on the underlying Linux operating system. This allows for the execution of arbitrary code with system-level access. **Recommendations** For Dataprobe iBoot PDU versions 1.43.03312023 or earlier, consider disabling the use of the `user-name` URL parameter until a patch is available to prevent command injection attacks. Restrict access to the affected URL endpoint to minimize the risk of exploitation. Avoid using the `user-name` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dataprobe iBoot PDU version 1.43.03312023 or earlier **Description** The issue concerns the use of hard-coded credentials for interactions with the internal Postgres database and an authentication bypass vulnerability in the REST API due to the mishandling of special characters when parsing credentials. This allows a malicious agent to obtain a valid authorization token, read information relating to the state of the relays and power distribution, and potentially read, modify, or delete arbitrary database records. **Recommendations** For version 1.43.03312023 or earlier, as a temporary workaround, consider restricting access to the REST API and the internal Postgres database to minimize the risk of exploitation. Avoid using special characters when parsing credentials in the REST API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dataprobe iBoot PDU version 1.43.03312023 or earlier **Description** The issue concerns authentication bypass in the REST API due to the mishandling of special characters when parsing credentials. Successful exploitation allows a malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution. **Recommendations** For version 1.43.03312023 or earlier, consider disabling the REST API until a patch is available to prevent exploitation. Restrict access to the API endpoints to minimize the risk of unauthorized access. Avoid using special characters in credentials for the affected API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dataprobe iBoot PDU versions 1.43.03312023 and earlier **Description** The issue concerns the use of hard-coded credentials for interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this to read, modify, or delete arbitrary database records. **Recommendations** For versions 1.43.03312023 and earlier, consider disabling access to the internal Postgres database until a patch is available. Restrict the ability to execute operating system commands on the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dataprobe iBoot PDU versions 1.43.03312023 or earlier **Description** The issue concerns a buffer overflow vulnerability in the librta.so.0.0.0 library. Successful exploitation could cause denial of service or unexpected behavior with respect to all interactions relying on the targeted vulnerable binary, including the ability to log in via the web server. Additionally, there is a vulnerability that allows an authenticated user to pass arbitrary OS commands through the `username` field when adding a remote backup location, potentially leading to the execution of arbitrary code with system-level access. **Recommendations** For Dataprobe iBoot PDU versions 1.43.03312023 or earlier, consider disabling the librta.so.0.0.0 library until a patch is available. As a temporary workaround, restrict access to the web server to minimize the risk of exploitation. Avoid using the `username` field when adding a remote backup location until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03 **Description** The issue is related to the use of uncontrolled format strings in the GTWWebMonitor.exe executable file of the SCADA Data Gateway system. An unauthenticated attacker can send specially crafted broadcast messages, including format string characters, to perform unrestricted memory reads. This can be used to repeatedly crash the GTWWebMonitor.exe process, resulting in a denial of service (DoS) of the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process, which could be used in an exploit chain to gain code execution. **Recommendations** For Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, consider disabling the GTWWebMonitor.exe process until a patch is available to prevent exploitation. Restrict access to the vulnerable SCADA Data Gateway to minimize the risk of unauthorized access. Avoid using the vulnerable version of the SCADA Data Gateway until an update or patch is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco IOx (affected versions not specified) **Description** A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This issue is due to incomplete sanitization of parameters passed for application activation. An attacker could exploit this by deploying and activating an application with a crafted activation payload file, potentially allowing the execution of arbitrary commands as root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foscam R2C IP camera versions System FW <= 1.13.1.6, and Application FW <= 2.91.2.66 **Description** A Time-of-check Time-of-use (TOCTOU) Race Condition issue allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. This could grant the attacker full remote access to the IP camera and the underlying Linux system with root permissions, enabling them to change the code, add backdoor access, or invade the user's privacy by accessing the live camera stream. **Recommendations** For Foscam R2C IP camera versions System FW <= 1.13.1.6, and Application FW <= 2.91.2.66, update the firmware to a version higher than System FW 1.13.1.6 and Application FW 2.91.2.66 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** com.onepeloton.erlich versions up to and including 1.7.22 **Description** Exposure of sensitive information to an unauthorized actor in the mobile application allows a remote attacker to access developer files stored in an AWS S3 bucket by reading credentials stored in plain text within the application. **Recommendations** For versions up to and including 1.7.22, update to a version that fixes the exposure of sensitive information to prevent unauthorized access to developer files stored in the AWS S3 bucket. As a temporary workaround, consider restricting access to the AWS S3 bucket until a patch is available.

Name of the Vulnerable Software and Affected Versions: Netop Vision Pro versions up to and including 9.7.1 Description: A local privilege escalation issue in Netop Vision Pro Windows clients allows a local user to gain administrator privileges while using the client. Recommendations: For versions up to and including 9.7.1, update to a version later than 9.7.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Netop Vision Pro versions up to and including 9.7.1 Description: The issue is related to an Improper Authorization vulnerability, which allows an attacker to replay network traffic. Recommendations: For versions up to and including 9.7.1, update to a version later than 9.7.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Netop Vision Pro versions up to and including 9.7.1 Description: The issue concerns the cleartext transmission of sensitive information, allowing a remote unauthenticated attacker to gather credentials, including Windows login usernames and passwords. Recommendations: For versions up to and including 9.7.1, update to a version later than 9.7.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Netop Vision Pro versions up to and including 9.7.1 Description: The issue is related to incorrect default permissions in the API of Netop Vision Pro, allowing a remote unauthenticated attacker to read and write files on the remote machine with system privileges, resulting in a privilege escalation. Recommendations: For versions up to and including 9.7.1, update to a version that includes a fix for the incorrect default permissions vulnerability to prevent privilege escalation. As a temporary workaround, consider restricting access to the API to minimize the risk of exploitation.