Abcd1234

**Name of the Vulnerable Software and Affected Versions** Totolink A3600R version 5.9c.4959 **Description** A security flaw exists in Totolink A3600R version 5.9c.4959. The issue resides within the `setAppEasyWizardConfig` function located in the `/lib/cste modules/app.so` library. Manipulation of the `apcliSsid` argument can lead to a buffer overflow. This issue is remotely exploitable. The exploit code has been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 US HG7 HG9 HG10re 300001138 en xpon (affected versions not specified) **Description** A flaw exists in the Boa Webserver component of Tenda HG10 US HG7 HG9 HG10re 300001138 en xpon. Specifically, a manipulation of the `serverString` argument within the /boaform/formSamba file can result in command injection. This allows for remote execution of commands. The exploit for this issue has been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 US HG7 HG9 HG10re 300001138 en xpon (affected versions not specified) **Description** A flaw exists in the Login Interface component of the software, specifically within the `checkUserFromLanOrWan` function located in the `/boaform/admin/formLogin` file. Manipulation of the `Host` argument can lead to command injection. This issue is remotely exploitable and the exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 US HG7 HG9 HG10re 300001138 en xpon (affected versions not specified) **Description** A flaw exists in the system function associated with the file '/boaform/formSysCmd'. Manipulation of the `sysCmd` argument can lead to command injection. This attack can be initiated remotely. The exploit has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.