Xiapu Luo

A command injection issue exists in the `pingtrace` function due to insufficient validation of the `host` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host machine.

A pre-authentication null pointer dereference occurs in the 'setget.cgi' interface. This issue stems from missing validation when the `pass` field is absent. A remote attacker can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

A command injection issue exists in the `dray apm` component. The flaw stems from insufficient validation of UDP message content following a `START SPEED TEST` request before the system executes commands. A remote attacker can exploit this by sending a specially crafted message to execute arbitrary commands with root privileges.

A command injection issue exists in the `commandTable()` function. The flaw stems from incomplete filtering of dangerous characters, including backticks, newline characters, and single quotes, within the `parameter` field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `sysreboot()` function. The flaw stems from insufficient filtering of the `config`, `act`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A pre-authentication command injection issue exists in the 'setget.cgi' interface. The flaw stems from insufficient filtering of the `pass` field before command execution, allowing a remote attacker to execute arbitrary commands with root privileges via crafted input.

A buffer overflow exists in the `setLan()` function due to missing length checks during memory copy operations. This issue affects the `lanVlanId0`, `lanIp`, and `lanNetmask` fields. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to cause a denial of service or execute arbitrary commands.

A command injection issue exists in the `apautotest()` function. The flaw stems from insufficient validation of the `CMD0`, `CMD3`, and `CMD6` fields before they are executed as commands. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the 'upload settings.cgi' interface. The flaw occurs due to insufficient filtering of the `restorekey` field before it is concatenated into a shell command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `jsonstatus()` function. The flaw stems from insufficient filtering of the `usescript`, `usefile`, and `option` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `webBackupAction()` function. The flaw stems from insufficient filtering of the `option`, `key`, `pw encode`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET /public/get-file/{path}' endpoint. The `path` route parameter is passed to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form, allowing the retrieval of sensitive files accessible to the PHP-FPM worker process. DrayTek VigorAP models contain a command injection flaw in the `ExportSettings()` function. Insufficient filtering of the `backupkey`, `backuptype`, and `realtime` fields allows a remote attacker with administrative credentials to execute arbitrary commands with root privileges.

A command injection issue exists in the `tr069TestInform()` function. The flaw arises from insufficient filtering of dangerous characters before the `event code` field is concatenated into a system command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A null pointer dereference occurs in the `formlogout()` function due to missing checks for an empty or absent Cookie header before string handling. A remote attacker with valid administrative credentials for the web management interface can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

A command injection issue exists in the `setcamset()` function. The flaw stems from insufficient filtering of the `selectSlaves` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `setLan()` function. The flaw stems from insufficient validation of the `lanIp` and `lanNetmask` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `mesh start speed test()` function. The flaw stems from insufficient sanitization of the `meshdevice index` and `meshdevice ip` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A command injection issue exists in the `InquierTime()` function. The flaw stems from insufficient filtering of the `time` field before it is used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

A buffer overflow exists in the `apautotest()` function. The issue stems from missing length checks during memory copy operations involving the `CMD6` field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to trigger a denial of service or execute arbitrary commands.

A command injection issue exists in the `auth set()` function. The flaw stems from insufficient filtering of the `username` and `password` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host.