Daniel Hulliger

**Name of the Vulnerable Software and Affected Versions** dali-devconfig (affected versions not specified) **Description** A remote attacker with user privileges can exploit a stack buffer overflow in the `dali-devconfig()` method to gain full system access with root privileges. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially allowing the execution of arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gdv-serverconfig (affected versions not specified) **Description** A remote attacker with user privileges can exploit a stack buffer overflow in the `gdv-serverconfig` method to gain full system access with root privileges. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially allowing the execution of arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Recover firmware (affected versions not specified) **Description** An unauthenticated remote attacker can recover a default, hard-coded password from a firmware image, allowing them to gain full access to affected devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Isolate affected devices immediately to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The `bac-scanresult()` method allows a remote attacker with user privileges to delete arbitrary local files. This is caused by insufficient validation of user-controlled input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The `ugw-logstop()` method allows a remote attacker with user privileges to terminate arbitrary processes. This is caused by insufficient validation of user-supplied input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The `ugw-logread()` method allows a remote attacker with user privileges to access arbitrary local files. This is caused by insufficient validation of user-supplied input, leading to a local file inclusion issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A remote attacker with user privileges can exploit a stack buffer overflow in the `bac-deviceobject()` method to gain full system access as root. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially allowing the execution of arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** versions (affected versions not specified) **Description** A remote attacker with low privileges can interact directly with the ''wwwdnload.cgi'' endpoint to download any resource available to administrators. This includes system backups and certificate request files. The attacker interacts with the endpoint to access resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** versions prior to 2025-41764 **Description** Insufficient authorization enforcement allows a remote attacker to upload and apply arbitrary updates by exploiting the `wwwupdate.cgi` API endpoint. The `wwwupdate.cgi` endpoint lacks proper access controls, enabling unauthorized modification of the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MBS UBR-01 Mk II (affected versions not specified) **Description** A low-privileged remote attacker can trigger a stack-based buffer overflow by sending a crafted HTTP POST request using the `ubr-network` method, potentially leading to full device compromise. The vulnerability is triggered via the `ubr-network` method. The affected API endpoint is a POST request. The `ubr-network` method is vulnerable to a stack-based buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBR (affected versions not specified) **Description** A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass in the web interface. The issue resides in the `wwwupdate.cgi` method. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UBR (affected versions not specified) **Description** An unauthenticated remote attacker can obtain valid session tokens. These tokens are exposed in plaintext within the URL parameters of the ''wwwupdate.cgi'' endpoint. The issue involves the exposure of session tokens, potentially allowing unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Versions prior to 2025-41765 **Description** Insufficient authorization enforcement allows a remote attacker to upload and apply arbitrary data through the `wwwupload.cgi` endpoint. This includes contact images, HTTPS certificates, system backups, server peer configurations, and BACnet/SC server certificates and keys. The `wwwupload.cgi` API endpoint is vulnerable to unauthorized data uploads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Atop Technologies EHG2408 series switch Atop Technologies EHG2408-2SFP **Description** The EHG2408 series switch developed by Atop Technologies contains a Stack-based Buffer Overflow issue. This allows unauthenticated remote attackers to control the program's execution flow and execute arbitrary code. The vulnerability presents a critical cyber threat and could serve as a pivot point for Operational Technology (OT) networks. **Recommendations** Versions prior to a fix are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wwwubr versions (affected versions not specified) **Description** A low-privileged remote attacker can exploit the `ubr-editfile` method in the ''wwwubr.cgi'' API endpoint to read arbitrary files on the system. The ''wwwubr.cgi'' endpoint is undocumented and unused. The vulnerable parameter is not specified. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wwwubr versions (affected versions not specified) **Description** A remote attacker with limited privileges can exploit the `ubr-logread` method in the ''wwwubr.cgi'' endpoint to read arbitrary files on the system. The endpoint accepts a parameter that specifies the log file to open, such as `/tmp/weblog{some number}`, but this parameter lacks proper validation. This allows an attacker to modify the parameter to reference any file and retrieve its contents. The vulnerable parameter is `some number`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.