Deral Heiland

Name of the Vulnerable Software and Affected Versions: Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier Description: The issue concerns insufficiently protected credentials in LDAP, allowing an attacker to reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker can force the target device to authenticate to the attacker-controlled LDAP service, enabling the capture of the plaintext password of the configured LDAP service. Recommendations: For version GCQ-Y3 or earlier, consider disabling the LDAP service until a patch is available to prevent reconfiguration by an attacker. Restrict access to the device's configuration to minimize the risk of exploitation. Avoid using the LDAP password on the target device until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) (affected versions not specified) **Description** The Genie Company Aladdin Connect garage door opener is vulnerable to XSS via a broadcast SSID name containing malicious code with client-side JavaScript and/or HTML when placed into configuration mode. This allows an attacker to inject malicious code into the user's web browser through the "Garage Door Control Module Setup" page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Genie Company Aladdin Connect Mobile Application versions 5.65 Build 2075 and below **Description** The issue concerns the storage of users' product account authentication data in clear text within the application. This allows an attacker with access to the Android device to potentially retrieve users' clear text authentication credentials. **Recommendations** For versions 5.65 Build 2075 and below, consider updating to a newer version that addresses the issue of storing authentication data in clear text, as this would mitigate the risk of credential exposure. As a temporary workaround, restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) (affected versions not specified) **Description** Unauthenticated access is permitted to the web interface page "Garage Door Control Module Setup" of The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM), allowing modification of the Garage door's SSID settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Baxter Spectrum WBM versions v16 through v17 Baxter Spectrum WBM versions v20D29 through v20D32 **Description** The issue allows for format string attacks via application messaging when in superuser mode, potentially enabling an attacker to read memory and access sensitive information. **Recommendations** For Baxter Spectrum WBM versions v16 through v17, restrict access to superuser mode to minimize the risk of exploitation. For Baxter Spectrum WBM versions v20D29 through v20D32, consider disabling application messaging until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Baxter Spectrum WBM (affected versions not specified) **Description** The issue concerns a lack of mutual authentication with the gateway server host. This could allow an attacker to perform a man-in-the-middle attack, modifying parameters to cause the network connection to fail. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Baxter Spectrum Wireless Battery Module (WBM) (affected versions not specified) **Description** The issue concerns the storage of network credentials and Protected Health Information (PHI) in unencrypted form, specifically applicable to Spectrum IQ pumps using auto programming. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Baxter Spectrum WBM (affected versions not specified) **Description** The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BlueCats Reveal versions prior to 3.0.19 **Description** The issue allows an attacker to compromise the affected BlueCats network implementation by accessing a clear text file that stores the `username` and `password`. This file remains on the device until the user logs out or the session times out after 30 days of inactivity. To exploit this, an attacker would first need to gain physical control of the Android device or compromise it with a malicious app. **Recommendations** For versions prior to 3.0.19, update to version 3.0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to prevent unauthorized physical or remote access to the Android device.

**Name of the Vulnerable Software and Affected Versions** iTrack Easy (affected versions not specified) **Description** The issue allows modification of getgps data without authentication by utilizing the `cmd:setothergps` parameter. This can be exploited to alter the GPS data of a lost device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zizai Tech Nut device (affected versions not specified) **Description** The issue allows unauthenticated Bluetooth pairing, enabling unauthenticated connected applications to write data to the `device name` attribute. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zizai Tech Nut mobile app (affected versions not specified) **Description** The issue concerns the storage of account passwords in cleartext within the cache.db file of the app, which is used for authentication to the cloud API. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zizai Tech Nut mobile app (affected versions not specified) **Description** The issue concerns the Zizai Tech Nut mobile app making requests via HTTP instead of HTTPS, which includes the user's authenticated session token in the URL. This allows an attacker to capture these requests and reuse the session token, potentially gaining full access to the user's account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iTrack Easy (affected versions not specified) **Description** The issue concerns the session management in iTrack Easy. Specifically, session cookies are not utilized to maintain valid sessions. Instead, the user's password is transmitted as a POST parameter over HTTPS on every request, using a base64 encoded `passwd` field. This means that sessions can only be terminated when the user changes the associated password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iTrack Easy mobile application (affected versions not specified) **Description** The issue concerns the storage of account passwords in the iTrack Easy mobile application. Specifically, the application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. Since base64 encoding is considered equivalent to cleartext, this poses a significant security risk. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iTrack (affected versions not specified) **Description** The issue concerns the iTrack device, where the tracking ID number, also referred to as "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iTrack Easy (affected versions not specified) **Description** The issue allows a captured MAC or device ID of an iTrack Easy to be registered under multiple user accounts, enabling access to getgps GPS data. This can permit unauthenticated parties to track the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.