Chazzhou

**Name of the Vulnerable Software and Affected Versions** D-Link DAR-7000 up to 20230922 **Description** A vulnerability was found in the file /log/decodmail.php of the D-Link DAR-7000, related to deserialization issues. The manipulation of the `file` argument leads to deserialization. The attack may be launched remotely. This issue affects some unknown functionality of the file /log/decodmail.php and may allow an attacker to elevate privileges, access the system, and execute arbitrary code. **Recommendations** As a temporary workaround, consider disabling access to the /log/decodmail.php file until a patch is available. Restrict access to the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ruijie RG-UAC version 1.0 **Description** The issue exists due to insufficient input validation in the `get ip.addr details` function of the `/view/vpn/autovpn/sxh vpnlic.php` file. This allows a remote attacker to execute arbitrary commands by manipulating the `indevice` argument, leading to command injection. The attack can be initiated remotely. **Recommendations** For Ruijie RG-UAC version 1.0, consider disabling the `get ip.addr details` function until a patch is available. Restrict access to the `/view/vpn/autovpn/sxh vpnlic.php` file to minimize the risk of exploitation. Avoid using the `indevice` argument in the affected HTTP POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.