Zwcrazythursday

The `rtmp i connect()` function passes the first RTMP connect argument to `amf0 object get()` without verifying if the AMF (Action Message Format) value is an object. If a string or number is provided instead of an AMF object, union bytes from the message are interpreted as node pointers and dereferenced. A client with network access to an enabled `mod rtmp` listener can send a malformed connect command before login, resulting in an invalid read that crashes the system and terminates all active calls. The `mod rtmp` module is disabled by default in the stock build and configuration.

The `chan ooh323` `Q.931 party-number parser` fails to properly handle malformed Q.931 elements within an `OOH323 request`, which can lead to a system crash. This issue occurs because a previous fix was not forward-ported to versions greater than 20. Exploitation requires the `chan ooh323` addon channel driver to be explicitly compiled, installed, and its port to be publicly reachable.

An authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` can execute write operations through `REST-over-WebSocket`. This authorization bypass allows for `arbitrary module path` loading and conditional remote code execution. The issue requires the Asterisk HTTP web server to be enabled and reachable, and the attacker must possess valid read-only ARI credentials.

An unbounded `sscanf` function in `res pjsip pubsub` occurs when parsing the `Message-Account` field of an `MWI NOTIFY` message. This allows an unauthenticated attacker to send a specially crafted packet that triggers a stack buffer overflow, corrupting the underlying transport and permanently disabling all SIP functionality. A system restart is necessary to restore operations.

An out-of-bounds write occurs in the `chan unistim` module during `DIALPAGE` digit handling, which can overflow the `phone number` field and cause the system to crash when a specially crafted incoming request packet is sent. This requires the `chan unistim` module to be loaded and configured with a reachable `UNISTIM UDP port`. Additionally, the attacker must register as a configured `phone MAC` or utilize a production/autoprovisioning path that grants access to the main page.

An OS command injection issue exists where the read ACL grants broad ubus access to docker.* and docker.container.*, exposing the `docker.container.ttyd start` method. The `run ttyd` handler constructs a shell command using the `id`, `cmd`, and `uid` variables from the request and passes it to the `system()` function without proper quoting or argv-style execution in the rpcd root context. An authenticated attacker with read ACL permissions can inject shell metacharacters into these variables, such as `id`, to execute arbitrary commands as root via an HTTP POST request to the `/ubus` endpoint.

An issue in the luci-app-samba4 package occurs because read Access Control Lists (ACLs) grant file execution permissions on `/usr/sbin/smbd`. This allows authenticated delegated users to execute the Samba daemon using command-line arguments controlled by the caller. By injecting arbitrary Samba global options, such as the message command, an attacker can trigger command execution with root privileges when SMB protocol messages are processed.

A privilege-escalation flaw exists where a LuCI/rpcd session with write ACL for luci-app-travelmate is granted config-wide UCI write access to the travelmate configuration. Although the user interface restricts the auto-login script selection to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service, which runs as root, reads the raw UCI `script` and `script args` values and executes the path when the captive-portal auto-login branch `f check()` in travelmate-functions.sh is reached. An attacker with delegated write permissions can change `script` to /bin/sh and provide controlled arguments in `script args` to execute arbitrary commands as root.