Weber Tsai

Name of the Vulnerable Software and Affected Versions: BatchSignCS (affected versions not specified) Description: BatchSignCS, a background Windows application developed by WellChoose, has an Arbitrary File Write vulnerability. If a user visits a malicious website while the application is running, remote attackers can write arbitrary files to any path, potentially leading to arbitrary code execution. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: HGiga OAKlouds mobile portal (affected versions not specified) Description: The HGiga OAKlouds mobile portal does not filter special characters of the `IPv6 Gateway` parameter of the network interface card setting page. Remote attackers can use this issue to perform command injection and execute arbitrary commands in the system without logging in. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: HGiga OAKlouds mobile portal (affected versions not specified) Description: The HGiga OAKlouds mobile portal does not filter special characters of the `Ethernet number` parameter of the network interface card setting page. Remote attackers can use this issue to perform command injection and execute arbitrary commands in the system without logging in. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iCatch DVR firmware version before 20200103 **Description** The file management interface of iCatch DVR contains broken access control, allowing an attacker to remotely manipulate arbitrary files. **Recommendations** For iCatch DVR firmware version before 20200103, update to a version 20200103 or later to resolve the issue. As a temporary workaround, consider restricting access to the file management interface until a patch is available.

**Name of the Vulnerable Software and Affected Versions** iCatch DVR firmware versions prior to 20200103 **Description** The issue is related to improper validation of function parameters, allowing attackers to execute arbitrary commands. **Recommendations** For iCatch DVR firmware versions prior to 20200103, update to a version 20200103 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TONNET TAT-76 series (affected versions not specified) TONNET TAT-77 series (affected versions not specified) **Description** The issue concerns the DVR firmware in TAT-76 and TAT-77 series of products, which do not properly verify patch files. This allows attackers to inject a specific command into a patch file, potentially gaining access to the system. **Recommendations** For TONNET TAT-76 series, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For TONNET TAT-77 series, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TONNET DVR firmware versions in TAT-76 and TAT-77 series (affected versions not specified) **Description** The issue concerns a misconfigured authentication mechanism in the DVR firmware. This allows attackers to crack the default password and gain access to the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ServiSign security plugin (affected versions not specified) **Description** An arbitrary-file-access issue exists, allowing attackers to access arbitrary files on the target system by learning a specific API function and crafting an API parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ServiSign security plugin (affected versions not specified) **Description** A Remote Code Execution issue exists in certain applications of the ServiSign security plugin. This allows attackers to execute arbitrary commands on the target system via maliciously crafted scripts, as long as the interface is captured. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.