Taizoh Tsukamoto

A missing authorization issue exists in NEC Platforms, Ltd. Aterm Series. This allows an attacker to obtain specific device information and modify settings through a network connection.

Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information issue. Exploitation may lead to the disclosure of configuration information, such as admin passwords.

Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. Exploitation may allow an arbitrary OS command to be executed and sensitive information to be obtained.

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue is related to an unprotected Windows messaging channel, also known as 'Shatter'. This allows an attacker to send a specially crafted message to a specific process of the Windows system where the product is running, potentially altering arbitrary files in the system. As a result, an arbitrary DLL may be executed with SYSTEM privilege. Recommendations: For Defense Platform Home Edition versions 3.9.51.x and earlier, consider restricting access to the Windows messaging channel to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A buffer overflow issue exists, allowing a remote attacker to potentially gain SYSTEM privileges of the Windows system where the product is installed, by performing a specific operation.

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue allows an attacker to obtain SYSTEM privilege of the Windows system where the product is running by performing a specific operation. This is due to an execution with unnecessary privileges issue. Recommendations: For Defense Platform Home Edition versions 3.9.51.x and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue exists due to an unprotected Windows messaging channel, also known as 'Shatter'. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege. Recommendations: For Defense Platform Home Edition versions 3.9.51.x and earlier, consider disabling the Windows messaging channel as a temporary workaround until a patch is available. Restrict access to the specific process of the Windows system where the product is running to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A NULL pointer dereference issue exists, allowing an attacker to cause a denial-of-service (DoS) condition by providing specially crafted data to a specific process of the Windows system where the product is running. This can result in a Blue Screen of Death (BSOD).

The issue is related to improper certificate validation, which may allow a network-adjacent unauthenticated attacker to obtain and/or alter communications of the affected product via a man-in-the-middle attack.

The issue allows an attacker to obtain specific files in the product due to improper limitation of a pathname to a restricted directory.

A directory traversal vulnerability allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings.

The issue allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions. This is due to an authentication bypass vulnerability.

The issue allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

A buffer overflow issue allows an attacker with administrative privileges to execute arbitrary code. The attack vector is not specified.

The issue allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability.

The issue allows an attacker on the adjacent network to obtain credentials for connecting to the Wi-Fi access point with the infrastructure mode due to insufficiently protected credentials.

The issue concerns a missing encryption of sensitive data, allowing an attacker with physical access to the device to obtain stored passwords.

Name of the Vulnerable Software and Affected Versions: ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior) ELECOM LAN routers (WRH-733GWH firmware v1.02.9 and prior) Description: The issue allows a network-adjacent attacker with administrator privilege to execute arbitrary OS commands via unspecified vectors. Recommendations: For ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior), update to a version later than v1.02.9. For ELECOM LAN routers (WRH-733GWH firmware v1.02.9 and prior), update to a version later than v1.02.9.

Name of the Vulnerable Software and Affected Versions: ELECOM LAN routers versions 1.02.9 and prior Description: A buffer overflow issue allows a network-adjacent attacker with administrator privileges to execute arbitrary OS commands via unspecified vectors. Recommendations: For versions 1.02.9 and prior, update to a version later than 1.02.9 to resolve the issue. As a temporary workaround, consider restricting administrator access to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: ELECOM LAN routers (WRH-733GBK) versions 1.02.9 and prior ELECOM LAN routers (WRH-733GWH) versions 1.02.9 and prior Description: The issue allows a network-adjacent attacker with administrator privilege to execute arbitrary OS commands via unspecified vectors. Recommendations: For ELECOM LAN routers (WRH-733GBK) versions 1.02.9 and prior, update to a version later than 1.02.9. For ELECOM LAN routers (WRH-733GWH) versions 1.02.9 and prior, update to a version later than 1.02.9.