Andrei Costin

**Name of the Vulnerable Software and Affected Versions** QNAP F VioCard 2312 (affected versions not specified) QNAP F VioGate 2308 (affected versions not specified) **Description** The issue concerns hardcoded entries in authorized keys files. It is noted that all active models are not affected, and the last affected model was end-of-life since 2010. Additionally, the legacy authorization mechanism is no longer used in active models. **Recommendations** For QNAP F VioCard 2312, consider removing the hardcoded entries in authorized keys files as a mitigation measure. For QNAP F VioGate 2308, consider removing the hardcoded entries in authorized keys files as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: NETGEAR Prosafe WC9500 version 5.1.0.17 NETGEAR Prosafe WC7600 version 5.1.0.17 NETGEAR Prosafe WC7520 version 2.5.0.35 Description: The issue allows a remote attacker to execute code with root privileges via shell metacharacters in the `reqMethod` parameter to "login handler.php". Recommendations: For NETGEAR Prosafe WC9500 version 5.1.0.17, consider disabling access to "login handler.php" until a patch is available. For NETGEAR Prosafe WC7600 version 5.1.0.17, restrict the use of the `reqMethod` parameter in "login handler.php" to minimize the risk of exploitation. For NETGEAR Prosafe WC7520 version 2.5.0.35, avoid using the `reqMethod` parameter in "login handler.php" until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: TRENDnet TS-S402 (affected versions not specified) Description: The issue concerns a backdoor that enables TELNET. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: QNAP VioCard 300 Description: The issue concerns hardcoded RSA private keys in the QNAP VioCard 300. This means that the device uses predefined, non-unique private keys for secure communication, which can be easily obtained by attackers. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Recommendations: For QNAP VioCard 300, consider disabling the use of RSA private keys until a patch or update is available that addresses this issue. As a temporary workaround, restrict access to sensitive features or modules that rely on these hardcoded keys to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Xerox ColorCube and WorkCenter devices (affected versions not specified) Description: The issue concerns hardcoded FTP and shell user accounts in Xerox ColorCube and WorkCenter devices. This hardcoded account issue could potentially allow unauthorized access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PQI AirCard (affected versions not specified) Description: The issue is related to a persistent XSS in PQI AirCard. No further details are provided about the estimated number of potentially affected devices or real-world incidents. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Transcend WiFiSD version 1.8 Description: The issue is related to persistent XSS. Recommendations: For Transcend WiFiSD version 1.8, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions 2007 SP2 through 2007 SP3 Microsoft Office version 2010 SP1 **Description** A remote code execution issue exists in the way Microsoft Office handles specially crafted Computer Graphics Metafile (CGM) graphics files. This could allow an attacker to execute arbitrary code or cause a denial of service due to memory corruption. An attacker who successfully exploits this issue could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Office 2007 SP2 and SP3, update to a version that is not affected by this issue. For Microsoft Office 2010 SP1, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of CGM files in Microsoft Office until a patch is available.