Sebastian Toscano

A denial of service condition exists due to SlowLoris attacks. This impacts the availability of the affected systems.

A malfunction exists in the Web UI when an unexpected locale is set via an API. The issue involves setting a locale through an API call, which leads to a Web UI malfunction. The API endpoint used is not specified. The vulnerable parameter or variable is not specified.

Multiple devices are sharing the same secrets for SDKSocket, which uses TCP port 5000. This could allow unauthorized access or compromise of devices utilizing this communication channel.

The file '/etc/avahi/services/z9.service' is susceptible to arbitrary writes. This allows unauthorized modification of the file.

The `/etc/timezone` file can be written to arbitrarily. This allows for potential modification of system-wide timezone settings.

The software exhibits an insufficient password policy. This allows for the use of weak or easily guessable passwords, potentially compromising account security.

The email server certificate verification is disabled, which allows for trivial man-in-the-middle (MITM) attacks. This poses a catastrophic security risk.

The software is missing security headers. This can potentially allow for various attacks, though specific details are not provided.

The credits page displayed in the firmware does not accurately reflect the versions in use.

The software experiences systemic internal server errors, resulting in HTTP 500 responses.

The software exhibits a lack of graceful error handling, resulting in HTTP 5xx errors.

The software is susceptible to a resource lacking authentication issue. This allows unauthorized access to resources.

The software reveals its version information. This could potentially allow attackers to gather information about the system to target it with specific exploits.

The software exhibits a non-compliant TLS configuration.

A systemic lack of Cross-Site Request Forgery (CSRF) token implementation exists. This complete absence of CSRF protections in BLU-IC controllers allows for trivial account takeover and system manipulation. Cross-Site Request Forgery (CSRF) is a type of web security flaw that allows an attacker to induce a user to perform actions on a web application in which they’re currently authenticated.

The software contains a privilege escalation issue stemming from a SUID-bit binary. This allows for potential unauthorized access and control within the system.

A flaw exists in the upgrade feature that could allow for arbitrary file writing, potentially leading to super user permissions on a device.

A flaw exists where protocol manipulation could result in a denial of service.

This issue involves local privilege escalation. The affected software allows an attacker to gain elevated privileges on a system. At the moment, there is no information about the number of potentially affected devices worldwide or any real-world incidents where this issue was exploited.

Error messages are wrapped in the HTTP header.