Bret Mcdanel

**Name of the Vulnerable Software and Affected Versions** Siglent SDS 1104X-E version 6.1.37R9.ADS **Description** The issue concerns an insecure SCPI interface that discloses the web password. **Recommendations** For Siglent SDS 1104X-E version 6.1.37R9.ADS, consider restricting access to the SCPI interface until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Siglent SDS 1104X-E SDS1xx4X-E version V6.1.37R9.ADS **Description** The issue concerns Incorrect Access Control, allowing an unauthenticated attacker to overwrite firmware. **Recommendations** For Siglent SDS 1104X-E SDS1xx4X-E version V6.1.37R9.ADS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Siglent SDS 1104X-E version 6.1.37R9.ADS **Description** The issue is related to a Denial of Service (DoS) that can be triggered on the user interface by a malformed SCPI command. **Recommendations** For Siglent SDS 1104X-E version 6.1.37R9.ADS, consider restricting the use of SCPI commands until a patch is available to prevent potential Denial of Service attacks.

**Name of the Vulnerable Software and Affected Versions** Siglent SDS 1104X-E version 6.1.37R9.ADS **Description** The issue is related to unfiltered user input, which results in Remote Code Execution (RCE) through the SCPI interface or web server. This is due to insufficient input validation, allowing an attacker to execute arbitrary code remotely. The lack of authentication in the SCPI interface of the Siglent SDS1104X-E digital oscilloscope software is a key factor in this issue. **Recommendations** For Siglent SDS 1104X-E version 6.1.37R9.ADS, consider disabling the SCPI interface or restricting access to the web server as a temporary workaround until a patch is available. Restricting input validation to prevent unfiltered user input can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.