A critical OS command injection vulnerability exists in the TFTP provisioning module of Zenitel EdgeAudioClient versions before 9.6.3.0 and 10.x before 10.1.3.0. This flaw allows unauthenticated adjacent attackers to execute arbitrary commands as root by supplying a crafted DHCP option 66 value via a rogue DHCP server on the same network segment. The vulnerability affects devices using DHCP on every boot and lease renewal. Additionally, the injection can be triggered through certain configuration fields if an attacker can modify the device configuration.
C-Kermit versions prior to 11.1.515 contain a heap buffer overflow vulnerability in the putsrv() function within ckcfns.c. This flaw allows malicious peers to write beyond the srvcmd buffer by sending specially crafted packets using Kermit repeat-count compression in server command, GET, or file-header packets. The vulnerability can lead to arbitrary code execution or denial of service on affected servers or receiving instances.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a vulnerability in certificate validation. The function ssl_reply() fails to call ssl_check_server_name(), allowing attackers to impersonate Telnet servers. This flaw enables machine-in-the-middle attackers to refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.
C-Kermit versions prior to 11.1.515 contain a vulnerability that allows malicious Kermit servers to bypass the RECEIVE CONFIRM prompt. This flaw enables attackers to write files without user consent by exploiting recursive GET root computation, potentially placing files like .ssh/authorized_keys or shell startup scripts in the current directory. Such unauthorized file writes can lead to persistent access or code execution.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 have a vulnerability in certificate hostname validation. This flaw allows attackers with a trusted certificate containing wildcard characters to impersonate hosts by exploiting improper matching in the DNS name comparison function. Successful exploitation can lead to interception of credentials and data over Telnet, FTP, and HTTP TLS connections.
C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw causes the Telnet authentication state to remain at AUTH_VALID after a refused certificate login. An attacker possessing a trusted certificate mapped to a refused account can exploit this to log in as any other account with any password, gaining shell access to that account.
Eclipse BaSyx Go Components versions up to and including 1.1.3 have an access control bypass vulnerability in ABAC-enabled deployments. The issue arises because access rules match the fully decoded request path, while routing uses the raw encoded path. This discrepancy allows an authenticated user with limited read permissions on parts of a resource to access the entire resource if the resource identifier contains encoded slashes. The vulnerability is fixed in version 1.1.4.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a buffer overflow vulnerability in the getreply() function within ckcftp.c. This flaw allows malicious FTP servers to overwrite client memory by sending excessively long security replies, specifically long PBSZ replies after AUTH TLS or long ADAT replies in certain authentication builds. The vulnerability can be exploited by attackers controlling or intercepting FTP servers to cause memory corruption.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a path traversal vulnerability in the doftpget() function. This flaw allows malicious FTP servers to manipulate file paths during recursive FTP get operations, potentially overwriting sensitive files such as .bashrc. Exploitation requires user interaction and can lead to code execution by overwriting configuration files.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 have a vulnerability that allows malicious senders to bypass file collision protection. This flaw lets attackers append data to existing files by marking transfers as RESEND. The issue arises because the gattr() function clears the REJECT discard flag and switches to APPEND mode without prompting for RECEIVE CONFIRM, enabling unauthorized file modifications such as altering shell startup files.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a buffer overflow vulnerability in the tn_snenv() function within ckctel.c. This flaw allows malicious Telnet servers or man-in-the-middle attackers to send specially crafted NEW-ENVIRON SEND subnegotiation messages before authentication, causing overflow of a 16-byte stack buffer and a miscalculated heap buffer. This memory corruption can compromise client memory integrity.
Dell PowerStore contains a content-injection vulnerability that allows an unauthenticated attacker to inject misleading text on the legitimate login page. This vulnerability could be exploited to facilitate phishing attacks by deceiving users. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A path traversal vulnerability exists in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in certain Zenitel devices running software versions from 10.0.3.0 up to but not including 10.1.3.0. Authenticated administrators can exploit this flaw by providing a crafted filename parameter with the type field set to any value other than https_certificate, bypassing path and certificate content validation. This allows arbitrary file write as root, which can lead to root-level arbitrary code execution by overwriting startup scripts or planting SSH keys.
Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability that allows authenticated administrators to execute arbitrary commands as root. This occurs via injection of newlines into the IPsec keyexchange field of the vpn.set_conf RPC method, enabling attackers to append malicious directives to the ipsec.conf file. The vulnerability leverages StrongSwan's updown plugin, which executes the appended commands with root privileges when an attacker-controlled peer establishes a CHILD_SA.
A vulnerability in Zenitel Connect firmware versions before 1.11.0 allows local attackers to execute database operations as the PostgreSQL superuser. The pREST database REST API signs and verifies JWTs using the platform CA private key, which is stored on a shared data volume accessible between containers. Attackers who can read this private key can forge JWTs with the sub claim set to 'postgres', enabling them to perform privileged database actions, including reading sensitive data such as the master encryption key and password hashes.
RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 has an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service exposed on TCP port 2001. This flaw allows remote attackers to send malicious serialized payloads to achieve remote code execution as NT AUTHORITY\SYSTEM, fully compromising the host.
A path traversal vulnerability exists in the certificate.deleteCertificate JSON-RPC method of the turbineweb web interface in certain Zenitel devices. Authenticated administrators can exploit this flaw by providing a relative path in the file_name parameter to delete arbitrary files as root. This can lead to denial of service or device inoperability by removing critical system files, including security-related files such as firewall rules or certificate trust stores.
An OS command injection vulnerability exists in the audio messages API of Zenitel Connect versions before 1.11.0. This flaw allows remote authenticated users to execute arbitrary operating system commands as root within the hiatus application container by exploiting the filename parameter in the /api/system/audio_messages endpoint.
A vulnerability in Zenitel Connect before version 1.11.0 allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host. This occurs because the host configuration watcher applies a rsyslog configuration file from a shared data volume, which can be crafted maliciously.
Cudy TR3000 devices running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by uploading specially crafted OpenVPN private or tls-auth keys. The attack involves closing the inline key block prematurely and injecting directives that bypass security restrictions, allowing OpenVPN to execute arbitrary commands as root.