Stephen Fewer

A flaw in the peering authentication mechanism of the control connection handshaking allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. The issue exists because the system fails to properly validate incoming certificates and tokens when specific header options are altered, specifically within the `vdaemon` service. An attacker can mimic a legitimate network controller by establishing a DTLS connection with a self-signed certificate and sending crafted requests to the peering authentication endpoint. Successful exploitation allows the attacker to log in as a high-privileged internal non-root user, granting access to NETCONF. This enables the manipulation of the entire SD-WAN fabric, including global routing tables, BGP routes, firewall rules, and VPN topology. The vulnerability has been actively exploited in the wild by threat actors, including a state-sponsored group designated as UAT-8616, who have used it to inject SSH keys, modify configurations, and escalate privileges to root.

Name of the Vulnerable Software and Affected Versions Brother MFC-L2710DW printers (affected versions not specified) Description A flaw exists in the firmware of Brother MFC-L2710DW printers that can lead to information disclosure regarding files and directories. Successful exploitation may allow a remote attacker to gain unauthorized access to protected information. The vulnerability involves the 'uscan' protocol from the eSCL specification, potentially revealing the serial number of the printer. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper neutralization of quoting syntax in PostgreSQL libpq functions, specifically `PQescapeLiteral()`, `PQescapeIdentifier()`, `PQescapeString()`, and `PQescapeStringConn()`. This allows a database input provider to achieve SQL injection in certain usage patterns, particularly when the application uses the function result to construct input to `psql`, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when `client encoding` is BIG5 and `server encoding` is one of EUC TW or MULE INTERNAL. The vulnerability has been exploited in real-world attacks, including the US Treasury hack, and is considered high-severity.

An attacker who can execute arbitrary Operating Systems commands can bypass code signing enforcements in the kernel and execute arbitrary native code. The issue allows manipulation that leads to insufficient data authenticity verification.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can perform an out of bounds heap read in the IQ Service (TCP port 9876). This issue is related to a buffer overflow in the IQ service's memory, which can allow a remote attacker to elevate their privileges to the root level and gain full access to the device. The exploitation occurs through a TCP connection on port 9876. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the IQ Service on TCP port 9876 until the firmware update is applied.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can perform a null pointer dereference in the `DHIP Service` using the UDP port `37810`. This issue can potentially allow a remote attacker to elevate privileges to the root level and gain full access to the device. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the `DHIP Service` on UDP port `37810` until the update is applied.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An authenticated attacker can trigger a stack-based buffer overflow in the DHIP Service (TCP port 80). This issue allows a remote attacker to potentially execute arbitrary code. The vulnerability is related to the DHIP service and can be exploited through a connection on TCP port 80. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the DHIP service on TCP port 80 until the update is applied.

Name of the Vulnerable Software and Affected Versions: Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111 Description: An unauthenticated attacker can trigger a stack-based buffer overflow in the DP Service (TCP port 3500). This issue can potentially allow a remote attacker to elevate their privileges to the root level and gain full access to the device. The vulnerability is related to a buffer overflow in the memory, which can be exploited by an attacker to gain control. Recommendations: For versions prior to 2.800.0000000.8.R.20241111, update the firmware to version 2.800.0000000.8.R.20241111 to resolve the issue. As a temporary workaround, consider restricting access to the DP Service on TCP port 3500 to minimize the risk of exploitation.

An OS command injection vulnerability exists in QNAP operating system versions due to the lack of neutralization of special elements used in the operating system command. This vulnerability could allow a remote attacker to execute arbitrary commands via a network. The issue is related to the quick.cgi file, which is used to configure uninitialized systems. There have been attempts to exploit this vulnerability, with code execution attempts targeting the '/cgi-bin/quick/quick.cgi' endpoint.

The issue allows an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). This is caused by a buffer overflow in the firmware loading module of the affected routers. Exploitation can occur through sending a specially crafted HTTP request.

The issue is related to a stack-based buffer overflow vulnerability and insufficient authorization in the web interface of the affected routers. This could allow a remote attacker to elevate privileges to the level of root, execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS).

The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary commands using a specially crafted request. The issue could also allow an attacker to execute arbitrary code, elevate privileges, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS).

The issue is related to a buffer overflow due to the lack of validation of the length of user-supplied data when handling SOAP requests, specifically when parsing the `SOAPAction` header. This allows an attacker to execute arbitrary code in the context of root without requiring authentication. The vulnerability can be exploited by network-adjacent attackers.

The issue is related to the lack of protection for internal data in the browser, which can be exploited by a remote attacker to gain access to confidential information. In the context of Firefox, if a Sandbox content process is compromised, it can initiate an FTP download. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and potentially allowing for a memory read of adjacent data from the privileged Chrome process, which may include sensitive data.

The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. The vulnerability is also described as a buffer data boundary operation issue, allowing a remote attacker to execute arbitrary code.

The issue is related to the destructor function for the WindowsDllDetourPatcher class, which can be exploited by malicious code to write arbitrary data to a controlled location in memory. This can bypass existing memory protections. The attack is limited to Windows operating systems. The vulnerability is associated with insufficient input validation in the destructor function of the WindowsDllDetourPatcher class in Firefox, Firefox ESR, and Thunderbird browsers, allowing a remote attacker to potentially elevate their privileges.

A directory traversal issue exists in the UploadServlet of the Remote Management component. This allows remote attackers to execute arbitrary code by sending a crafted zenworks-fileupload request. The request must include a specific directory name in the `type` parameter, a WAR filename in the `filename` parameter, and WAR content in the POST data.

The issue is related to incorrect access to objects in memory, which can cause a memory error and allow an attacker to execute arbitrary code in the context of the current user. This is a remote code execution issue.

The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This occurs because Internet Explorer improperly accesses objects in memory, potentially corrupting memory in a way that enables an attacker to execute arbitrary code in the context of the current user.

The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code via a crafted web site, triggering access to a deleted object. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.