Sinsinology

**Name of the Vulnerable Software and Affected Versions** Progress Kemp LoadMaster versions GA v7.2.63.1 and earlier Progress Kemp LoadMaster versions LTSF v7.2.54.17 and earlier MOVEit WAF versions prior to GA v7.2.63.2 Progress ECS Connection Manager (affected versions not specified) Progress Object Scale Connection Manager (affected versions not specified) **Description** An OS command injection flaw in the API of Progress ADC products allows an unauthenticated remote attacker to execute arbitrary commands as root on the LoadMaster appliance. The issue stems from unsanitized input in multiple command endpoints. Specifically, the `escape quotes()` function in the `/accessv2` endpoint uses `malloc()` instead of `calloc()`, resulting in uninitialized heap memory, and fails to append a null terminator to the output string. This allows an attacker to read past the buffer boundary and inject shell commands into a `system()` call via the `apiuser` variable. Over 100,000 deployments are estimated worldwide, and active exploitation has been observed, including nearly 300 instances exposed online. **Recommendations** Update Progress Kemp LoadMaster GA to version 7.2.63.2 or later. Update Progress Kemp LoadMaster LTSF to a version containing the fix. Update MOVEit WAF to version GA v7.2.63.2 or later. As a temporary mitigation, restrict access to the `/accessv2` API endpoint or disable the API if not required.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.2.3 through 12.2.14 **Description** Oracle E-Business Suite is affected by a critical remote code execution (RCE) vulnerability (CVE-2025-61882). This flaw allows unauthenticated attackers to execute arbitrary code, potentially leading to full system compromise and data theft. The vulnerability is actively exploited by the Cl0p ransomware group. Exploitation involves bypassing authentication through the BI Publisher Integration component, utilizing SSRF, CRLF injection, and XSLT template manipulation. A public proof-of-concept exploit is available. Multiple organizations have been impacted, with reports of data exfiltration and extortion attempts. Indicators of compromise (IOCs) have been shared by security researchers. **Recommendations** Oracle E-Business Suite versions 12.2.3 through 12.2.14: Apply the security patch released by Oracle immediately.

**Name of the Vulnerable Software and Affected Versions** Fortinet FortiSIEM versions 5.4.0 through 7.3.1 Fortinet FortiSIEM versions 6.1 through 7.3.1 Fortinet FortiSIEM versions 6.7 through 7.5 Fortinet FortiSIEM versions 7.0.0 through 7.0.3 Fortinet FortiSIEM versions 7.1.0 through 7.1.7 Fortinet FortiSIEM versions 7.2.0 through 7.2.5 **Description** Fortinet FortiSIEM is affected by an improper neutralization of special elements used in an OS command, also known as OS Command Injection (CWE-78). This allows an unauthenticated attacker to execute arbitrary code or commands via crafted CLI requests. Active exploitation of this issue has been confirmed, and exploit code is publicly available. The vulnerability impacts the phMonitor port (TCP/7900). There have been reports of brute-force attacks targeting Fortinet products preceding exploitation of this flaw. **Recommendations** Fortinet FortiSIEM versions 5.4.0 through 7.3.1: Upgrade to version 7.3.2 or later. Fortinet FortiSIEM versions 6.1 through 6.7.9: Upgrade to version 6.7.10 or later. Fortinet FortiSIEM versions 7.0.0 through 7.0.3: Upgrade to version 7.0.4 or later. Fortinet FortiSIEM versions 7.1.0 through 7.1.7: Upgrade to version 7.1.8 or later. Fortinet FortiSIEM versions 7.2.0 through 7.2.5: Upgrade to version 7.2.6 or later. As a temporary workaround, restrict access to the phMonitor port (TCP/7900).

**Name of the Vulnerable Software and Affected Versions** Kenwood DMX958XR (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices without authentication. The flaw resides within the firmware update process due to insufficient validation of user-supplied strings before they are used in system calls, enabling an attacker to execute code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell Unity versions prior to 5.5.1 Dell UnityVSA versions prior to 5.5.1 **Description** Dell Unity and UnityVSA contain an Improper Neutralization of Special Elements used in an OS Command vulnerability, also known as OS Command Injection. An unauthenticated, remote attacker could potentially exploit this issue to execute arbitrary commands on the system. The vulnerability stems from improper handling of login redirect URIs, allowing an attacker to insert shell metacharacters into a command execution string during the redirect process. This could lead to unauthorized configuration changes, data access, or complete control over the appliance. **Recommendations** Upgrade to version 5.5.1 or later to address this vulnerability.

Name of the Vulnerable Software and Affected Versions: Autel MaxiCharger AC Wallbox Commercial (affected versions not specified) Description: This issue allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. The specific flaw exists within the Pile API, resulting from the lack of authentication prior to allowing access to functionality. An attacker can leverage this issue to disclose credentials, leading to further compromise. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Autel MaxiCharger AC Wallbox (affected versions not specified) **Description** The issue concerns an Incorrect Authorization Privilege Escalation Vulnerability in the Commercial Technician API of the Autel MaxiCharger AC Wallbox. This was discovered by Sina Kheirkhah of Summoning Team during Pwn2Own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Autel MaxiCharger AC Wallbox (affected versions not specified) **Description** The issue concerns a dangerous method information disclosure vulnerability where the commercial serial number is exposed. This vulnerability was discovered by Sina Kheirkhah of Summoning Team. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Autel MaxiCharger AC Wallbox Commercial Firmware (affected versions not specified) **Description** The issue concerns a remote code execution vulnerability due to a firmware downgrade in the Autel MaxiCharger AC Wallbox Commercial. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Technical details about exploitation are not specified. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Autel MaxiCharger AC Wallbox Commercial (affected versions not specified) **Description** The issue concerns an Origin Validation Error Authentication Bypass Vulnerability. It allows for authentication bypass due to an origin validation error. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WOLFBOX Level 2 EV Charger (affected versions not specified) **Description** This issue allows physically present attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger. The specific flaw exists within the handling of management cards, resulting from the lack of personalization of these cards. An attacker can leverage this vulnerability to bypass authentication on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WOLFBOX Level 2 EV Charger (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The flaw exists within the Tuya communications module software, resulting from the exposure of a method that allows the upload of crafted software images to the module. An attacker can leverage this issue to execute code in the context of the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Alpine iLX-507 (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required for exploitation. The flaw resides within the `UPDM wstpCBCUpdStart` function due to insufficient validation of user-supplied data before executing a system call, enabling an attacker to execute code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ivanti Connect Secure versions prior to 22.7R2.5 Ivanti Policy Secure versions prior to 22.7R1.2 Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3 **Description** A stack-based buffer overflow exists in the affected software, allowing a remote unauthenticated attacker to achieve remote code execution. This issue has been exploited in the wild by financial institutions and government agencies using an ELF-based remote-access Trojan (RAT) known as DslogdRAT. The exploitation process involves disabling SELinux, preventing syslog forwarding, remounting the drive as read-write, and deploying web shells. Attackers also use a tool called PHASEJAM to display fake update progress bars to deceive administrators and manipulate the Ivanti Integrity Checker Tool (ICT) manifest to bypass integrity checks. Technical analysis of the associated malware reveals the use of the `init config()` function to decrypt configuration buffers via XOR cipher, and the `child()` function to maintain persistence through continuous forking. Networking capabilities are managed by the `test()` function, which utilizes `connectx()` for outbound communication and `listenx()` for inbound connectivity. **Recommendations** Update Ivanti Connect Secure to version 22.7R2.5 or later. Update Ivanti Policy Secure to version 22.7R1.2 or later. Update Ivanti Neurons for ZTA gateways to version 22.7R2.3 or later. Run the external Ivanti ICT tool to verify system integrity.

**Name of the Vulnerable Software and Affected Versions** ChargePoint Home Flex (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. No authentication is required to exploit this issue. The specific flaw exists within the `wlanapp` module, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** ChargePoint Home Flex (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. No authentication is required to exploit this issue. The specific flaw exists within the `onboardee` module and results from improper access control, allowing an attacker to execute code in the context of `root`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** VMware HCX versions prior to 4.8.3 VMware HCX versions prior to 4.9.2 VMware HCX versions prior to 4.10.1 **Description** An authenticated SQL injection flaw exists in the `listExtensions` method of VMware Hybrid Cloud Extension (HCX). Successful exploitation allows a malicious, authenticated user with non-administrator privileges to execute arbitrary code on the HCX manager by submitting specially crafted SQL queries. The vulnerability is identified as CVE-2024-38814 and has a CVSS score of 8.8 (High). The vulnerability resides in the way the software handles the structure of SQL requests, failing to implement adequate protection measures. **Recommendations** Update to VMware HCX version 4.8.3 or later. Update to VMware HCX version 4.9.2 or later. Update to VMware HCX version 4.10.1 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this issue. The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: GFI Archiver (affected versions not specified) Description: This issue allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is not required to exploit this issue. The specific flaw exists within the product installer, resulting from the use of a vulnerable version of Telerik Web UI. An attacker can leverage this issue to execute code in the context of NETWORK SERVICE. Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver (affected versions not specified) **Description** The issue is a remote code execution vulnerability due to the deserialization of untrusted data in the GFI Archiver Store Service. This allows remote attackers to execute arbitrary code on affected installations of GFI Archiver, but authentication is required to exploit this vulnerability. The specific flaw exists within the Store Service, which listens on TCP port 8018 by default, and is the result of the lack of proper validation of user-supplied data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.