Adrien Rey

**Name of the Vulnerable Software and Affected Versions** Recover firmware (affected versions not specified) **Description** An unauthenticated remote attacker can recover a default, hard-coded password from a firmware image, allowing them to gain full access to affected devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Isolate affected devices immediately to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The `bac-scanresult()` method allows a remote attacker with user privileges to delete arbitrary local files. This is caused by insufficient validation of user-controlled input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The `ugw-logstop()` method allows a remote attacker with user privileges to terminate arbitrary processes. This is caused by insufficient validation of user-supplied input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The `ugw-logread()` method allows a remote attacker with user privileges to access arbitrary local files. This is caused by insufficient validation of user-supplied input, leading to a local file inclusion issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A remote attacker with user privileges can exploit a stack buffer overflow in the `bac-deviceobject()` method to gain full system access as root. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially allowing the execution of arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dali-devconfig (affected versions not specified) **Description** A remote attacker with user privileges can exploit a stack buffer overflow in the `dali-devconfig()` method to gain full system access with root privileges. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially allowing the execution of arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gdv-serverconfig (affected versions not specified) **Description** A remote attacker with user privileges can exploit a stack buffer overflow in the `gdv-serverconfig` method to gain full system access with root privileges. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially allowing the execution of arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Versions prior to 2025-41765 **Description** Insufficient authorization enforcement allows a remote attacker to upload and apply arbitrary data through the `wwwupload.cgi` endpoint. This includes contact images, HTTPS certificates, system backups, server peer configurations, and BACnet/SC server certificates and keys. The `wwwupload.cgi` API endpoint is vulnerable to unauthorized data uploads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MBS UBR-01 Mk II (affected versions not specified) **Description** A low-privileged remote attacker can trigger a stack-based buffer overflow by sending a crafted HTTP POST request using the `ubr-network` method, potentially leading to full device compromise. The vulnerability is triggered via the `ubr-network` method. The affected API endpoint is a POST request. The `ubr-network` method is vulnerable to a stack-based buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wwwubr versions (affected versions not specified) **Description** A low-privileged remote attacker can exploit the `ubr-editfile` method in the ''wwwubr.cgi'' API endpoint to read arbitrary files on the system. The ''wwwubr.cgi'' endpoint is undocumented and unused. The vulnerable parameter is not specified. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBR (affected versions not specified) **Description** An unauthenticated remote attacker can obtain valid session tokens. These tokens are exposed in plaintext within the URL parameters of the ''wwwupdate.cgi'' endpoint. The issue involves the exposure of session tokens, potentially allowing unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBR (affected versions not specified) **Description** A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass in the web interface. The issue resides in the `wwwupdate.cgi` method. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wwwubr versions (affected versions not specified) **Description** A remote attacker with limited privileges can exploit the `ubr-logread` method in the ''wwwubr.cgi'' endpoint to read arbitrary files on the system. The endpoint accepts a parameter that specifies the log file to open, such as `/tmp/weblog{some number}`, but this parameter lacks proper validation. This allows an attacker to modify the parameter to reference any file and retrieve its contents. The vulnerable parameter is `some number`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Versions prior to 2025-41756 **Description** A low-privileged remote attacker can exploit the `ubr-editfile` method in the `/wwwubr.cgi` API endpoint to write arbitrary files on the system. The `/wwwubr.cgi` endpoint is undocumented and unused. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBR (affected versions not specified) **Description** A remote attacker with limited privileges can misuse the backup restore functionality of `ubr-restore`, which operates with elevated privileges. The software does not validate the contents of the backup archive, allowing an attacker to create or overwrite arbitrary files on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Versions (affected versions not specified) **Description** A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the `wwupload.cgi` API endpoint. This is due to path traversal, which can lead to overwriting arbitrary files on the device and achieving a full system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.