Cale Black

**Name of the Vulnerable Software and Affected Versions** SmarterTools SmarterMail versions prior to build 9518 **Description** The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. This affects the background-of-the-day preview endpoint. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication. The vulnerability allows an attacker to provide input that is then used as a filesystem path without proper validation. **Recommendations** Update SmarterTools SmarterMail to build 9518 or later.

**Name of the Vulnerable Software and Affected Versions** SmarterTools SmarterMail versions prior to build 9511 **Description** An issue exists in the 'ConnectToHub' API method, specifically at the endpoint '/api/v1/settings/sysadmin/connect-to-hub', due to missing authentication for a critical function. This allows an unauthenticated remote attacker to point the server to a malicious HTTP server using the `hubAddress` parameter. The server then fetches attacker-controlled JSON, which triggers the `CommandMount` function to execute arbitrary OS commands under the SYSTEM context. This flaw has been actively exploited in ransomware campaigns, including attacks by the Warlock ransomware group, which compromised SmarterTools' own internal infrastructure. Over 6,000 exposed instances have been identified globally, with more than 1,000 exploitation attempts observed within a two-week period. **Recommendations** Update SmarterMail to build 9511 or later. As a temporary workaround, restrict access to the '/api/v1/settings/sysadmin/connect-to-hub' API endpoint. Monitor SmarterMail logs for suspicious outbound connections to unknown HTTP endpoints and unexpected POST requests to the 'ConnectToHub' endpoint.

**Name of the Vulnerable Software and Affected Versions** Flowise versions 3.0.1 through 3.0.7 Flowise versions 3.0.8 and later with 'ALLOW BUILTIN DEP' enabled **Description** The software contains an authenticated remote code execution issue and a node VM sandbox escape. This is due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker who can create or run a tool leveraging Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, these attacker-controlled elements are run on the host, bypassing the nodevm sandbox restrictions and allowing for arbitrary code execution in the host's context. The developers initially misidentified this as a duplicate of another issue. **Recommendations** Update to Flowise version 3.0.8 or later and ensure 'ALLOW BUILTIN DEP' is disabled. For versions prior to 3.0.8, consider restricting access to tools that leverage Puppeteer/Playwright.

Name of the Vulnerable Software and Affected Versions: DIAEnergie (affected versions not specified) Description: The software contains a reflected cross-site scripting issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: DIAEnergie (affected versions not specified) Description: The software contains a stored cross-site scripting issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: DIAEnergie (affected versions not specified) Description: This issue is a reflected cross-site scripting vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: DIAEnergie (affected versions not specified) Description: The software contains a reflected cross-site scripting issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BigAntSoft BigAnt Server versions up to and including 5.6.06 **Description** The issue concerns unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution. **Recommendations** For BigAntSoft BigAnt Server versions up to and including 5.6.06, consider disabling the "Cloud Storage Addin" to prevent the execution of arbitrary PHP code until a patch is available. Restrict access to the account registration mechanism to minimize the risk of exploitation. Avoid using the default exposed SaaS registration mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sage X3 System (affected versions not specified) Description: The issue allows an authenticated user with developer access to inject OS commands via the `CHAINE` variable used by the web application. It is noted that this developer configuration should not be deployed in production. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sage X3 versions prior to 9 with Syracuse 9.22.7.2 Sage X3 HR & Payroll versions prior to 9 with Syracuse 9.24.1.3 Sage X3 versions prior to 11 with Syracuse 11.25.2.6 Sage X3 versions prior to 12 with Syracuse 12.10.2.8 Description: A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. This issue can be combined with another vulnerability to achieve full remote code execution (RCE). Recommendations: For Sage X3 versions prior to 9 with Syracuse 9.22.7.2, update to AdxAdmin 93.2.53 or later. For Sage X3 HR & Payroll versions prior to 9 with Syracuse 9.24.1.3, update to AdxAdmin 93.2.53 or later. For Sage X3 versions prior to 11 with Syracuse 11.25.2.6, update to AdxAdmin 93.2.53 or later. For Sage X3 versions prior to 12 with Syracuse 12.10.2.8, update to AdxAdmin 93.2.53 or later.

**Name of the Vulnerable Software and Affected Versions** Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0 **Description** The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command, which launches a standard vi editor interface that can then be escaped. **Recommendations** For Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2, update to version 5.0.2 or later. For Akkadian OVA appliance versions prior to 3.0, update to version 3.0 or later. For Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0, update to version 3.3.0.314-4a349e0 or later.

**Name of the Vulnerable Software and Affected Versions** Akkadian Provisioning Manager Engine versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0 **Description** The issue allows an attacker to bypass the restricted shell provided by Akkadian Provisioning Manager Engine by switching the OpenSSH channel from `shell` to `exec` and providing a single execution parameter. This could potentially allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Akkadian Provisioning Manager Engine versions prior to 5.0.2, update to version 5.0.2 or later. For Akkadian OVA appliance versions prior to 3.0, update to version 3.0 or later. For Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0, update to version 3.3.0.314-4a349e0 or later.

**Name of the Vulnerable Software and Affected Versions** Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0 **Description** The issue concerns a hard-coded credential, with the username `akkadianuser` and password `haakkadianpassword`. This poses a significant security risk as it could allow unauthorized access. **Recommendations** For Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2, update to version 5.0.2 or later. For Akkadian OVA appliance versions prior to 3.0, update to version 3.0 or later. For Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0, update to version 3.3.0.314-4a349e0 or later.

**Name of the Vulnerable Software and Affected Versions** Crestron Console service versions 1.3384.00049.001 and lower **Description** The issue concerns command injection that can be used to gain root-level access. This affects devices with default configuration, specifically DGE-100, DM-DGE-200-C, and TS-1542-C devices. **Recommendations** For versions 1.3384.00049.001 and lower, update the firmware to a version higher than 1.3384.00049.001 to resolve the issue.