Vinícius Moraes

**Name of the Vulnerable Software and Affected Versions** Multilaser RE160V version 12.03.01.09 pt Multilaser RE163V version 12.03.01.10 pt **Description** An issue in the firmware allows attackers to bypass access control and gain complete access to the application via modifying an HTTP header. This enables attackers to access the application without proper authorization. **Recommendations** For Multilaser RE160V version 12.03.01.09 pt, consider restricting access to the application until a patch is available. For Multilaser RE163V version 12.03.01.10 pt, consider restricting access to the application until a patch is available. As a temporary workaround, consider disabling the modification of HTTP headers to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Multilaser RE160 versions 5.07.51 pt MTL01 through 5.07.52 pt MTL01 Multilaser RE160V versions 12.03.01.08 pt through 12.03.01.09 pt Multilaser RE163V version 12.03.01.08 pt **Description** The issue allows attackers to bypass access control and gain complete access to the application by supplying a crafted URL. This enables attackers to manipulate the URL and access the application without proper authorization. **Recommendations** For Multilaser RE160 versions 5.07.51 pt MTL01 through 5.07.52 pt MTL01, consider restricting access to the application until a patch is available. For Multilaser RE160V versions 12.03.01.08 pt through 12.03.01.09 pt, avoid using manipulated URLs in the application to minimize the risk of exploitation. For Multilaser RE163V version 12.03.01.08 pt, as a temporary workaround, consider disabling access to the application via crafted URLs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Multilaser RE160 firmware versions 5.07.51 pt MTL01 through 5.07.52 pt MTL01 **Description** The issue allows attackers to bypass access control and gain complete access to the application by supplying a crafted cookie. This enables attackers to manipulate the cookie and gain unauthorized access. **Recommendations** For versions 5.07.51 pt MTL01 and 5.07.52 pt MTL01, consider restricting access to the application until a patch is available. As a temporary workaround, avoid using the vulnerable cookie manipulation feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.