Wr3Nchsr

Name of the Vulnerable Software and Affected Versions: ZTE routers (affected versions not specified) Description: The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in the `session init` function. This function executes session -LUA- files stored in the `/var/lua session` directory using the `dofile` function without validation. An attacker who can write a malicious file in the sessions directory can achieve remote code execution as root. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ZTE routers (affected versions not specified) Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in the `rsa decrypt` function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, and the decrypted data is stored on the stack without checking its length. An authenticated attacker can get remote code execution (RCE) as root by exploiting this vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ZTE routers (affected versions not specified) Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in the `check data integrity` function. This function is responsible for validating the checksum of data in post requests. The checksum is sent encrypted in the request, and the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can gain remote code execution (RCE) as root by exploiting this vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ZTE Routers (affected versions not specified) Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in the `webPrivateDecrypt` function. This function is responsible for decrypting RSA encrypted ciphertext, where the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checking its length. An unauthenticated attacker can gain remote code execution (RCE) as root by exploiting this vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware SD-WAN Edge (affected versions not specified) **Description** The issue is related to an unauthenticated command injection vulnerability in the VMware SD-WAN Edge, potentially leading to remote code execution. A malicious actor with local access to the Edge Router UI during activation may be able to perform a command injection attack, which could lead to full control of the router. The vulnerability is associated with the failure to neutralize special elements used in the OS command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware SD-WAN Edge (affected versions not specified) **Description** The issue is related to a missing authentication and protection mechanism in the VMware SD-WAN Edge appliance. A malicious actor with physical access to the appliance during activation can potentially exploit this to access the BIOS configuration. Additionally, the malicious actor may be able to exploit the default boot priority configured. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Huawei datacom product (affected versions not specified) **Description** An improper access control issue exists, allowing attackers to exploit it and obtain partial device information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Huawei data communication product (affected versions not specified) **Description** The issue is related to a command injection vulnerability. Successful exploitation of this vulnerability may allow attackers to gain higher privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722 **Description** The issue allows the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this. **Recommendations** For PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722, consider restricting physical USB access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the exec service until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722 **Description** The issue allows an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this issue. **Recommendations** For PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722, consider restricting shell access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** PAX Technology A930 PayDroid version 7.1.1 Virgo V04.5.02 20220722 **Description** The issue allows attackers to compile a malicious shared library and use LD PRELOAD to bypass authorization checks. This can be achieved by utilizing the `LD PRELOAD` environment variable to load a malicious shared library, which can then be used to bypass authorization checks. **Recommendations** For PAX Technology A930 PayDroid version 7.1.1 Virgo V04.5.02 20220722, consider restricting the use of the `LD PRELOAD` environment variable to minimize the risk of exploitation. Additionally, monitor for any suspicious library loading activity to detect potential attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PAX A930 device with PayDroid versions 7.1.1 Virgo V04.3.26T1 20210419 through 7.1.1 Virgo V04.4.02 20211201 **Description** The issue allows a root privileged attacker to install unsigned packages on the device. To exploit this, the attacker must have shell access to the device and gain root privileges. This can be done by copying the APK to `/data/app`, setting the appropriate permissions, and rebooting the device. **Recommendations** For PayDroid version 7.1.1 Virgo V04.3.26T1 20210419, consider restricting access to the device's shell to prevent attackers from gaining root privileges. For PayDroid version 7.1.1 Virgo V04.4.02 20211201, avoid using the device's package installation feature until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419 PAX Technology A930 PayDroid version 7.1.1 Virgo V04.4.02 20211201 **Description** The issue allows an attacker to gain root access through command injection in the systool client. This can be exploited if the attacker has shell access to the device. The systool server fails to check for dollar signs or backticks in user-supplied commands, leading to arbitrary command execution as root. **Recommendations** For PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419, consider disabling the systool client until a patch is available. For PAX Technology A930 PayDroid version 7.1.1 Virgo V04.4.02 20211201, restrict access to the systool server to minimize the risk of exploitation. As a temporary workaround, avoid using user-supplied commands that contain dollar signs or backticks in the systool server until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PAX A930 device with PayDroid versions 7.1.1 Virgo V04.3.26T1 20210419 through 7.1.1 Virgo V04.4.02 20211201 **Description** The issue allows an unauthorized attacker to perform privileged actions through the execution of specific binaries listed in the ADB daemon. The attacker must have physical USB access to the device in order to exploit this issue. The ADB daemon in PAX Technology A930 PayDroid allows the execution of the systool utility in production mode, enabling unauthenticated attackers to perform privileged actions. **Recommendations** For PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419, consider restricting physical USB access to the device to minimize the risk of exploitation. For PAX A930 device with PayDroid version 7.1.1 Virgo V04.4.02 20211201, avoid using the ADB daemon in production mode until a fix is available. As a temporary workaround, consider disabling the execution of specific binaries listed in the ADB daemon until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PAX A930 device with PayDroid versions 7.1.1 Virgo V04.3.26T1 20210419 through 7.1.1 Virgo V04.4.02 20211201 **Description** The issue allows the execution of specific command injections on selected binaries in the ADB daemon shell service. An attacker must have physical USB access to the device to exploit this. **Recommendations** For PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419, consider restricting physical USB access to minimize the risk of exploitation. For PAX A930 device with PayDroid version 7.1.1 Virgo V04.4.02 20211201, consider restricting physical USB access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.