Tian

A use after free issue in the Windows System Events Broker allows an authorized attacker to locally disclose sensitive information and affect the system. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A stack-based buffer overflow exists in the Wireless Wizard Handler component within the `/goform/formWizSurvey` endpoint. This issue occurs when the `interface1` or `interface2` arguments are manipulated, allowing for remote exploitation.

An out-of-bounds write can be triggered remotely via the L2TP Control Channel Parser component. The issue exists within the `tunnel set params()` function located in the `tunnel.c` file, where improper manipulation of data leads to memory corruption.

A flaw exists in the `websRedirect()` function of the goform Handler component. A remote attacker can manipulate the `submit-url` argument to cause an open redirect, which occurs when an application redirects a user to an untrusted external site. This issue affects multiple endpoints.

A remote attack is possible due to an out-of-bounds write in the `rp-l2tp` component. The issue exists within the `tunnel set params()` function located in the `tunnel.c` file, where manipulation of the `peer hostname` argument triggers the flaw.

A remote out-of-bounds write can occur within the L2TP Control Message Parser component. This issue is triggered by the `tunnel set params()` function, allowing an attacker to write data beyond the allocated memory buffer.

A stack-based buffer overflow exists in the `udhcpcd` component. The issue occurs within the `sendOffer/sendACK` functions of the `udhcpcd/serverpacket.c` file. This flaw allows for manipulation that can be triggered by an attacker located within the local network.

A stack-based buffer overflow exists in the `udhcpcd` component. The issue occurs within the `strcpy()` function located in the `udhcpcd/serverpacket.c` file. This flaw allows a remote, unauthenticated attacker to trigger the overflow without any user interaction.

An off-by-one error exists in the L2TP Control Message Parser within the `tunnel set params()` function of the `progs.gpl/pppd.alpha/l2tp/tunnel.c` file. A remote attacker can trigger this issue by manipulating the `peer hostname` argument. This type of attack is considered highly complex and difficult to execute.

A remote command injection issue exists within the `udhcpcd` component. The flaw is located in the `sendACK()` function of the `udhcpcd/serverpacket.c` file. An attacker can execute arbitrary commands remotely by manipulating the `Hostname` argument.

A command injection flaw exists in the Web Interface component. A remote attacker can exploit this by manipulating the `pppUserName` or `pptpUserName` arguments within the '/goform/setWAN' endpoint. Command injection is a type of attack where an attacker executes arbitrary operating system commands on the target server.

A command injection flaw exists in the L2TP Mode component. The issue occurs within the `setWAN()` function of the '/goform/setWAN' endpoint. A remote attacker can exploit this by manipulating the `L2TPUserName` argument to execute arbitrary commands.

A buffer overflow can be triggered remotely via an unknown function within the '/goform/setWAN' endpoint. This occurs through the manipulation of the `pptpDfGateway` argument.

A buffer overflow can be triggered remotely via a manipulation of the `pptpDfGateway` argument within an unknown function of the '/goform/setWAN' file.

A command injection issue exists in the udhcpd DHCP Service within the `system()` function of the `/udhcpcd/dhcpd.c` file. A remote attacker can exploit this by manipulating the `Hostname` argument to execute arbitrary code. This issue occurs because the software fails to neutralize special elements within the input.

A buffer overflow exists in the nmbd component of the firmware due to a lack of input size verification during buffer copying. Specifically, the issue resides in the `NMBD process()` function within the sserver.c file. A remote attacker located within the local network can exploit this by sending a specially crafted request to execute arbitrary code.

A buffer overflow exists in the `miniupnpd` component within the `upnpsoap.c` file. The issue occurs in the `AddPortMapping()` function when it fails to properly validate the size of input data during the copying of the `NewPortMappingDescription` argument. This flaw allows an attacker on the local network to execute arbitrary code by sending a specially crafted HTTP request. Millions of devices worldwide are potentially affected.

A security issue exists in Edimax BR-6288ACL versions up to 1.12. The `wiz WISP24gmanual` function within the `wiz WISP24gmanual.asp` file is susceptible to cross site scripting due to manipulation of the `manualssid` argument. This allows for remote attacks. The vendor has stated the product is end-of-life and will issue a security advisory on their official support website. The exploit has been publicly disclosed.

A flaw exists in the `auth check userpass2` function that allows for the use of default credentials through manipulation of the `Username/Password` argument. This issue can be exploited remotely. The vendor has confirmed the product is end-of-life and will issue a security advisory.

A flaw exists in the `formStaDrvSetup` function within the `/goform/formStaDrvSetup` file. Manipulation of the `submit-url` argument can lead to an open redirect. This issue can be exploited remotely. The vendor has confirmed the product is end-of-life and will issue a security advisory on their official support website.