Bronallo-Bd

**Name of the Vulnerable Software and Affected Versions** Zephyr OS (affected versions not specified) **Description** The issue concerns the handling of IP packets in Zephyr OS. Specifically, it does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.0.1 or the destination address. This could potentially lead to security issues, although specific details about the estimated number of affected devices or real-world incidents are not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cacti version 1.2.25 **Description** Cacti provides an operational monitoring and fault management framework. A Blind SQL Injection vulnerability exists within the SNMP Notification Receivers feature in the file `managers.php`. An authenticated attacker with the "Settings/Utilities" permission can send a crafted HTTP GET request to the endpoint `/cacti/managers.php` with an SQLi payload in the `selected graphs array` HTTP GET parameter. The vulnerability could lead to information disclosure and potentially remote code execution. Approximately 60,887 devices are potentially affected, mainly distributed in the United States, China, and other countries. **Recommendations** As a temporary workaround, consider disabling the `selected graphs array` parameter in the `/cacti/managers.php` endpoint until a patch is available. Restrict access to the `managers.php` file to minimize the risk of exploitation. Avoid using the `selected graphs array` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions >= v2.5.0 **Description** The issue is related to a reachable assertion with repeated LL FEATURE REQ, which is classified as a Reachable Assertion (CWE-617). **Recommendations** For Zephyr versions >= v2.5.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions >= v2.5.0 **Description** The issue arises from an invalid channel map in CONNECT IND, resulting in a deadlock due to improper check or handling of exceptional conditions. This is classified as CWE-703. **Recommendations** For Zephyr versions >= v2.5.0, consider temporarily disabling the CONNECT IND functionality until a patch is available to prevent deadlocks caused by invalid channel maps. Restrict access to the vulnerable module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions >= v2.4.0 **Description** The issue is related to information leakage in the `le ecred conn req()` function, which is caused by the use of an uninitialized resource. This is classified as a CWE-908 vulnerability. **Recommendations** For Zephyr versions >= v2.4.0, consider disabling the `le ecred conn req()` function until a patch is available to prevent potential information leakage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions >= v2.5.0 **Description** A stack-based buffer overflow issue exists in the `le ecred conn req()` function. This issue is related to a stack-based buffer overflow, which can be exploited. **Recommendations** For Zephyr versions >= v2.5.0, consider disabling the `le ecred conn req()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions >= v1.14 **Description** The issue is related to a reachable assertion with repeated LL CONNECTION PARAM REQ, which is classified as a Reachable Assertion (CWE-617). This occurs when the `LL CONNECTION PARAM REQ` is repeated, leading to an assertion being reachable. **Recommendations** For Zephyr versions >= v1.14, consider disabling the repeated `LL CONNECTION PARAM REQ` to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Zephyr versions 2.4.0 and later Description: The issue is caused by a truncated L2CAP K-frame, leading to an assertion failure. This is due to improper handling of length parameter inconsistency and a reachable assertion. Recommendations: For Zephyr versions 2.4.0 and later, update to a version that contains a fix for the improper handling of length parameter inconsistency and reachable assertion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.