Sinsinology

A local privilege escalation flaw exists in the Fiv service due to an exposed dangerous method. An attacker who has already obtained the ability to execute low-privileged code on the system can leverage this issue to escalate their privileges and execute arbitrary code with root permissions.

Network-adjacent attackers can execute arbitrary code on affected devices without authentication. The flaw resides in the SSH service due to the use of hard-coded credentials, allowing code execution in the context of the `telechips` user.

An OS command injection flaw in the API of Progress ADC products allows an unauthenticated remote attacker to execute arbitrary commands as root on the LoadMaster appliance. The issue stems from unsanitized input in multiple command endpoints. Specifically, the `escape quotes()` function in the `/accessv2` endpoint uses `malloc()` instead of `calloc()`, resulting in uninitialized heap memory, and fails to append a null terminator to the output string. This allows an attacker to read past the buffer boundary and inject shell commands into a `system()` call via the `apiuser` variable. Over 100,000 deployments are estimated worldwide, and active exploitation has been observed, including nearly 300 instances exposed online.

An unauthenticated remote code execution flaw exists in the BI Publisher Integration component of Oracle Concurrent Processing. The issue stems from authentication and authorization deficiencies, allowing an attacker to compromise the system by sending specially crafted HTTP requests. Specifically, the exploitation targets the XML Publisher Template Manager via the `/OA HTML/RF.jsp` and `/OA HTML/OA.jsp` endpoints. Attackers can upload a malicious XSLT template that executes embedded commands when previewed, enabling the deployment of web shells and backdoors. Real-world exploitation has been attributed to threat actors including Cl0p, Scattered LAPSUS$ Hunters, and GRACEFUL SPIDER. It is estimated that over 40 organizations have been confirmed as victims, with potentially more than 100 affected. Notable victims include Harvard University, The Washington Post, Logitech, and Korean Air. These attacks primarily focused on the massive theft of corporate financial data, intellectual property, and employee records for extortion purposes.

Fortinet FortiSIEM is affected by an improper neutralization of special elements used in an OS command, also known as OS Command Injection (CWE-78). This allows an unauthenticated attacker to execute arbitrary code or commands via crafted CLI requests. Active exploitation of this issue has been confirmed, and exploit code is publicly available. The vulnerability impacts the phMonitor port (TCP/7900). There have been reports of brute-force attacks targeting Fortinet products preceding exploitation of this flaw.

This issue allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices without authentication. The flaw resides within the firmware update process due to insufficient validation of user-supplied strings before they are used in system calls, enabling an attacker to execute code with root privileges.

Dell Unity and UnityVSA contain an Improper Neutralization of Special Elements used in an OS Command vulnerability, also known as OS Command Injection. An unauthenticated, remote attacker could potentially exploit this issue to execute arbitrary commands on the system. The vulnerability stems from improper handling of login redirect URIs, allowing an attacker to insert shell metacharacters into a command execution string during the redirect process. This could lead to unauthorized configuration changes, data access, or complete control over the appliance.

Name of the Vulnerable Software and Affected Versions: Autel MaxiCharger AC Wallbox Commercial (affected versions not specified) Description: This issue allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. The specific flaw exists within the Pile API, resulting from the lack of authentication prior to allowing access to functionality. An attacker can leverage this issue to disclose credentials, leading to further compromise. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns an Incorrect Authorization Privilege Escalation Vulnerability in the Commercial Technician API of the Autel MaxiCharger AC Wallbox. This was discovered by Sina Kheirkhah of Summoning Team during Pwn2Own.

The issue concerns a dangerous method information disclosure vulnerability where the commercial serial number is exposed. This vulnerability was discovered by Sina Kheirkhah of Summoning Team.

The issue concerns a remote code execution vulnerability due to a firmware downgrade in the Autel MaxiCharger AC Wallbox Commercial. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Technical details about exploitation are not specified.

The issue concerns an Origin Validation Error Authentication Bypass Vulnerability. It allows for authentication bypass due to an origin validation error.

This issue allows physically present attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger. The specific flaw exists within the handling of management cards, resulting from the lack of personalization of these cards. An attacker can leverage this vulnerability to bypass authentication on the system.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The flaw exists within the Tuya communications module software, resulting from the exposure of a method that allows the upload of crafted software images to the module. An attacker can leverage this issue to execute code in the context of the device.

This issue allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required for exploitation. The flaw resides within the `UPDM wstpCBCUpdStart` function due to insufficient validation of user-supplied data before executing a system call, enabling an attacker to execute code with root privileges.

A stack-based buffer overflow and out-of-bounds memory read exist in the affected software. This allows a remote unauthenticated attacker to achieve remote code execution and elevate privileges. Real-world exploitation has been observed since mid-December 2024, targeting financial institutions and government agencies. Attackers have utilized an ELF-based remote-access Trojan (RAT) known as DslogdRAT, which employs a configuration setup routine `init config()` to decrypt settings using an XOR cipher and a `child()` function to maintain persistence through continuous forking. The exploitation process involves disabling SELinux, preventing syslog forwarding, remounting the drive as read-write, deploying web shells, and manipulating the Ivanti Integrity Checker Tool (ICT) manifest to bypass integrity checks. Additionally, the PHASEJAM malware has been used to display fake update progress bars to deceive administrators while blocking legitimate system updates.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. No authentication is required to exploit this issue. The specific flaw exists within the `wlanapp` module, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. No authentication is required to exploit this issue. The specific flaw exists within the `onboardee` module and results from improper access control, allowing an attacker to execute code in the context of `root`.

An authenticated SQL injection flaw exists in the `listExtensions` method of VMware Hybrid Cloud Extension (HCX). Successful exploitation allows a malicious, authenticated user with non-administrator privileges to execute arbitrary code on the HCX manager by submitting specially crafted SQL queries. The vulnerability is identified as CVE-2024-38814 and has a CVSS score of 8.8 (High). The vulnerability resides in the way the software handles the structure of SQL requests, failing to implement adequate protection measures.

This issue allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this issue. The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM.