Thijs Alkemade

**Name of the Vulnerable Software and Affected Versions** QuRouter versions prior to 2.4.5.032 **Description** A command injection issue has been reported, potentially allowing remote attackers to execute arbitrary commands. **Recommendations** For versions prior to 2.4.5.032, update to QuRouter version 2.4.5.032 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iXsystems TrueNAS CORE (affected versions not specified) **Description** This issue allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. The specific flaw exists within the handling of firmware updates, resulting from the use of an insecure protocol to deliver updates. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. No authentication is required to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iXsystems TrueNAS CORE versions prior to 13.0-U6.3 **Description** The issue is related to the tarfile.extractall method, which lacks proper validation of a user-supplied path prior to using it in file operations. This allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices without requiring authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. **Recommendations** For versions prior to 13.0-U6.3, update to version 13.0-U6.3 to resolve the issue. As a temporary workaround, consider restricting access to the tarfile.extractall method until a patch is available. Avoid using the `tarfile.extractall` method in file operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Windows Kernel (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel. It is associated with the failure to neutralize special elements. Exploitation of this issue may allow an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ChargePoint Home Flex (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the handling of OCPP messages due to the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ChargePoint Home Flex (affected versions not specified) **Description** This issue allows network-adjacent attackers to compromise transport security on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `CURLOPT SSL VERIFYHOST` setting, resulting from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other issues to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Autel MaxiCharger AC Elite Business C50 (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow vulnerability in the handling of base64-encoded data within WebSocket messages. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 chargers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of base64-encoded data within WebSocket messages, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to the use of an unreliable path search in the Windows kernel, allowing an attacker to elevate their privileges. This can affect the system, potentially leading to unauthorized access or control. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.1 **Description** The issue is related to insufficient access control in the LaunchServices component of the macOS operating system, which may allow an app to access sensitive user data. The issue was addressed with improved permissions logic. **Recommendations** For versions prior to 14.1, update to macOS Sonoma 14.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive user data until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14 **Description** The issue allows an app to bypass Gatekeeper checks. It was addressed with improved checks. **Recommendations** For versions prior to 14, update to macOS Sonoma 14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Windows 11 (affected versions not specified) **Description** The vulnerability is related to insufficient input validation in the Windows Themes component, allowing remote attackers to execute arbitrary code on the system. This can occur when a user opens a malicious .THEME file. The issue has been exploited in real-world incidents, with proof-of-concept exploit code published. A successful exploit could grant attackers complete control over the victim's system, allowing them to install malware, steal sensitive data, or launch further attacks within the network. **Recommendations** To resolve the issue, install Microsoft's September 2023 security updates as soon as possible to protect your system from attacks. The updates are available through Windows Update and the Microsoft Update Catalog. As a temporary workaround, consider avoiding the use of .THEME files from untrusted sources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions 11.7.7 and earlier macOS Monterey versions 12.6.6 and earlier macOS Ventura versions 13.4 and earlier **Description** A logic issue was addressed with improved checks, which may allow an app to gain root privileges. The issue is related to insecure privilege management in the libxpc library of MacOS operating systems, potentially allowing an attacker to execute arbitrary code with root privileges. **Recommendations** For macOS Big Sur versions 11.7.7 and earlier, update to macOS Big Sur 11.7.7 or later. For macOS Monterey versions 12.6.6 and earlier, update to macOS Monterey 12.6.6 or later. For macOS Ventura versions 13.4 and earlier, update to macOS Ventura 13.4 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16.6 iPadOS versions prior to 16.6 **Description** The issue was addressed with improvements to the file handling protocol. An app may be able to break out of its sandbox. **Recommendations** For iOS versions prior to 16.6, update to iOS 16.6 to resolve the issue. For iPadOS versions prior to 16.6, update to iPadOS 16.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.7.2 macOS versions prior to 12.6.2 macOS versions prior to 13.1 **Description** A type confusion issue was addressed with improved checks. Processing a maliciously crafted package may lead to arbitrary code execution. **Recommendations** For macOS versions prior to 11.7.2, update to macOS Big Sur 11.7.2. For macOS versions prior to 12.6.2, update to macOS Monterey 12.6.2. For macOS versions prior to 13.1, update to macOS Ventura 13.1.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13 **Description** An access issue was addressed with additional sandbox restrictions. This issue allows an app to potentially break out of its sandbox. **Recommendations** For versions prior to 13, update to macOS Ventura 13 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13 **Description** The issue allows an app to modify protected parts of the file system. This was addressed with improved data protection. **Recommendations** For versions prior to 13, update to macOS Ventura 13 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** AVEVA Edge versions 2020 SP2 Patch 0(4201.2111.1802.0000) **Description** The issue is related to an uncontrolled search path element in the AVEVA Edge SCADA system, which can be exploited to execute arbitrary code or elevate privileges. Remote attackers can exploit this by loading a library from an unsecured location, specifically within the handling of APP files. User interaction is required, where the target must visit a malicious page or open a malicious file, allowing an attacker to execute code in the context of the current process. **Recommendations** For AVEVA Edge version 2020 SP2 Patch 0(4201.2111.1802.0000), consider restricting the handling of APP files until a patch is available. As a temporary workaround, avoid opening malicious files or visiting untrusted pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Unified Automation OPC UA C++ Demo Server version 1.7.6-537 **Description** This issue allows remote attackers to create a denial-of-service condition on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of certificates. A crafted certificate can force the server into an infinite loop, allowing an attacker to create a denial-of-service condition on the system. **Recommendations** For Unified Automation OPC UA C++ Demo Server version 1.7.6-537, consider disabling the certificate handling functionality until a patch is available to prevent exploitation. Restrict access to the server to minimize the risk of denial-of-service attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.5 macOS Big Sur versions prior to 11.6.8 Security Update versions prior to 2022-005 Catalina **Description** An access issue was addressed with improvements to the sandbox, allowing an app to potentially access sensitive user information. **Recommendations** For macOS versions prior to 12.5, update to macOS Monterey 12.5. For macOS Big Sur versions prior to 11.6.8, update to macOS Big Sur 11.6.8. For Security Update versions prior to 2022-005 Catalina, apply Security Update 2022-005 Catalina.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition version 8.1.15 (b2022030114) **Description** This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `authenticateAdSso` method, resulting from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this issue to execute code in the context of SYSTEM. **Recommendations** For Inductive Automation Ignition version 8.1.15 (b2022030114), as a temporary workaround, consider disabling the `authenticateAdSso` method until a patch is available. Restrict access to the python code execution functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.