Allanp0E

**Name of the Vulnerable Software and Affected Versions** Comfast CF-AC100 version 2.6.0.8 **Description** A command injection issue exists in Comfast CF-AC100 firmware. The issue is related to the manipulation of the file `/cgi-bin/mbox-config?method=SET&section=ntp timezone`. This allows for remote exploitation. The exploit has been publicly disclosed. The vulnerable function is unknown. The vendor was contacted but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-AC100 version 2.6.0.8 **Description** A command injection issue exists in Comfast CF-AC100 version 2.6.0.8. The issue affects an unknown function within the file `/cgi-bin/mbox-config?method=SET&section=update interface png`. Successful exploitation of this issue allows for remote command execution. The exploit for this issue has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-AC100 version 2.6.0.8 **Description** A command injection issue exists in Comfast CF-AC100 version 2.6.0.8. The issue impacts an unknown function within the file `/cgi-bin/mbox-config?method=SET&section=wireless device dissoc`. Successful manipulation of this function allows for remote command execution. The exploit for this issue has been publicly released. The vendor was notified of the issue but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Comfast CF-AC100 versão 2.6.0.8 **Descrição** Uma vulnerabilidade de injeção de comandos existe no componente Request Path Handler do Comfast CF-AC100 versão 2.6.0.8. A vulnerabilidade está localizada na função `sub 44AC14` do arquivo `/cgi-bin/mbox-config?method=SET&section=ping config`. A manipulação deste componente pode resultar em injeção de comandos. O ataque pode ser lançado remotamente. O exploit está disponível publicamente. O fornecedor foi notificado, mas não respondeu. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-E7 version 2.6.0.9 **Description** A command injection issue exists due to manipulation of the `timestr` argument in the `sub 41ACCC` function of the `/cgi-bin/mbox-config?method=SET&section=ntp timezone` file within the webmggnt component. This allows for remote execution of commands. The exploit is publicly available. The vendor was notified but did not respond. **Recommendations** Versions prior to 2.6.0.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-E7 version 2.6.0.9 **Description** A flaw exists in Comfast CF-E7 version 2.6.0.9 that allows for remote command injection. The issue is located within the `webmggnt` component, specifically in the `sub 441CF4` function of the `/cgi-bin/mbox-config?method=SET&section=ping config` file. Manipulation of the `destination` argument can trigger the command injection. An exploit for this issue has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1 V2 version 2.6.0.2 **Description** A remote command injection issue exists in Comfast CF-N1 V2 2.6.0.2. The issue is located in the `sub 44AC4C` function within the `/cgi-bin/mbox-config` file. Manipulation of the `bandwidth` argument in the 'ptest bandwidth' section of the file allows for remote code execution. The exploit for this issue has been publicly disclosed. The vendor was notified but did not respond. **Recommendations** For Comfast CF-N1 V2 version 2.6.0.2, as a temporary workaround, consider restricting access to the `/cgi-bin/mbox-config` file to minimize the risk of exploitation. Avoid using the `bandwidth` parameter in the affected API endpoint `/cgi-bin/mbox-config?method=SET&section=ptest bandwidth` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1 V2 version 2.6.0.2 **Description** A command injection issue exists in Comfast CF-N1 V2. The issue is located in the `sub 44AB9C` function of the `/cgi-bin/mbox-config` file. Manipulation of the `channel` parameter in the `ptest channel` section of the API endpoint `/cgi-bin/mbox-config?method=SET&section=ptest channel` can lead to command injection. The attack can be initiated remotely. **Recommendations** Versions prior to 2.6.0.2 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Wavlink WL-NU516U1 versão 240425 **Descrição** Existe uma vulnerabilidade de injeção de comando na função `usb p910` do arquivo `/cgi-bin/adm.cgi`. A manipulação do argumento `Pr mode` pode resultar em execução remota de comandos. O exploit foi divulgado publicamente. **Recomendações** Aplique atualizações para corrigir a vulnerabilidade na função `usb p910` do arquivo `/cgi-bin/adm.cgi`. Como medida paliativa, restrinja o acesso ao arquivo `/cgi-bin/adm.cgi`. Evite utilizar o parâmetro `Pr mode` no endpoint da API afetado até que o problema seja resolvido.

**Nome do Software Vulnerável e Versões Afetadas** Wavlink WL-NU516U1 versão 240425 **Descrição** Existe uma falha na função `ota new upgrade` do arquivo `/cgi-bin/adm.cgi`. A manipulação do argumento `model` pode levar à injeção de comandos. Isso permite ataques remotos. O exploit foi publicado. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do Software Vulnerável e Versões Afetadas** D-Link DCS-933L versões até a 1.14.11 **Descrição** Existe uma falha no D-Link DCS-933L que permite injeção de comandos. Este problema decorre da manipulação do argumento `AdminID` dentro de uma função desconhecida do arquivo `/setSystemAdmin`, parte do componente `alphapd`. A exploração bem-sucedida permite que atacantes remotos executem comandos no sistema. O exploit está disponível publicamente. Esta vulnerabilidade afeta produtos não mais suportados pelo mantenedor. **Recomendações** Versões anteriores à 1.14.11 não devem ser utilizadas.

**Name of the Vulnerable Software and Affected Versions** Ziroom ZHOME A0101 version 1.0.1.0 **Description** A security flaw exists in Ziroom ZHOME A0101. The issue is due to command injection resulting from the manipulation of the `macType` argument within the `macAddrClone` function located in the `lucicontrollerapizrMacClone.lua` file. This allows for remote attacks. The exploit has been publicly released. The vendor was notified but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.