Cyber Guy

**Name of the Vulnerable Software and Affected Versions** SeowonIntech SWC 5100W WIMAX Bootloader version 1.18.19.0, HW version 0.0.7.0, and FW versions 1.11.0.1, 1.9.9.4 **Description** The issue allows attackers to take over the system with root privilege by abusing the `doSystem()` function, enabling OS Command Injection. This allows for the execution of arbitrary system commands, potentially leading to a full system compromise. **Recommendations** For SeowonIntech SWC 5100W WIMAX Bootloader version 1.18.19.0, consider disabling the `doSystem()` function to prevent OS Command Injection until a patch is available. For HW version 0.0.7.0, restrict access to the system to minimize the risk of exploitation. For FW versions 1.11.0.1 and 1.9.9.4, avoid using the vulnerable `doSystem()` function in critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Franklin Fueling System FFS Colibri version 1.9.22.8925 **Description** The issue allows an attacker to overwrite system files, such as `system.conf` and `passwd`, due to the insecure usage of the `fopen` system function with the mode `wb`, which allows overwriting files if they exist. This can enable an attacker to escalate privileges by planting a backdoor user with root privilege or changing the root password. **Recommendations** For Franklin Fueling System FFS Colibri version 1.9.22.8925, consider disabling the use of the `fopen` system function with the mode `wb` until a patch is available to prevent the overwriting of system files. Restrict access to sensitive files such as `system.conf` and `passwd` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pyscriptjs (aka PyScript Demonstrator) versions through 2022-05-04 **Description** The issue allows a remote user to read Python source code. **Recommendations** For versions through 2022-05-04, at the moment, there is no information about a newer version that contains a fix for this vulnerability.