Zikh26

**Name of the Vulnerable Software and Affected Versions** Tenda W18E version 16.01.0.11 **Description** A problematic vulnerability was found in Tenda W18E, affecting the `formSetAccountList` function of the file `/goform/setModules`. The manipulation of the `Password` argument leads to a stack-based buffer overflow. This attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** As a temporary workaround, consider disabling the `formSetAccountList` function until a patch is available. Restrict access to the `/goform/setModules` file to minimize the risk of exploitation. Avoid using the `Password` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** H3C Magic NX15 versões até V100R014 H3C Magic NX30 Pro versões até V100R014 H3C Magic NX400 versões até V100R014 H3C Magic R3010 versões até V100R014 H3C Magic BE18000 versões até V100R014 **Descrição** Um problema crítico afeta alguma funcionalidade desconhecida do arquivo `/api/esps` do componente Manipulador de Requisição HTTP POST, levando à injeção de comando. O ataque pode ser lançado remotamente. O exploit foi divulgado ao público e pode ser utilizado. O fabricante foi contatado antecipadamente sobre esta divulgação, mas não respondeu de forma alguma. **Recomendações** Para H3C Magic NX15 versões até V100R014, considere desativar o endpoint `/api/esps` no Manipulador de Requisição HTTP POST até que um patch esteja disponível. Para H3C Magic NX30 Pro versões até V100R014, restrinja o acesso ao endpoint `/api/esps` no Manipulador de Requisição HTTP POST para minimizar o risco de exploração. Para H3C Magic NX400 versões até V100R014, evite utilizar o endpoint `/api/esps` no Manipulador de Requisição HTTP POST até que o problema seja resolvido. Para H3C Magic R3010 versões até V100R014, considere implementar medidas de segurança adicionais para prevenir injeção de comando remota. Para H3C Magic BE18000 versões até V100R014, desative temporariamente o Manipulador de Requisição HTTP POST até que uma correção esteja disponível.

**Name of the Vulnerable Software and Affected Versions** H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 **Description** A critical vulnerability was found in the HTTP POST Request Handler component, affecting an unknown functionality of the file "/api/login/auth". The manipulation leads to command injection, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For H3C Magic NX15 versions up to V100R014, consider disabling the "/api/login/auth" endpoint until a patch is available. For H3C Magic NX30 Pro versions up to V100R014, restrict access to the HTTP POST Request Handler component to minimize the risk of exploitation. For H3C Magic NX400 versions up to V100R014, avoid using the vulnerable functionality of the "/api/login/auth" file until the issue is resolved. For H3C Magic R3010 versions up to V100R014, as a temporary workaround, consider disabling the HTTP POST Request Handler component until a patch is available. For H3C Magic BE18000 versions up to V100R014, restrict access to the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.