H4Lo

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers (affected versions not specified) Description: The issue is related to the web-based management interface of the affected devices, which discloses sensitive information due to inadequate authorization procedures. This could allow a remote attacker to elevate privileges from a guest to an admin level by sending crafted HTTP input to the affected device. Recommendations: As a temporary workaround, consider restricting access to the web-based management interface until a patch is available. Avoid using the web-based management interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-LINK TL-WDR5620 version 2.3 **Description** A remote code execution vulnerability exists in the TP-LINK TL-WDR5620 via the `httpProcDataSrv` function. This issue occurs due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code. **Recommendations** For TP-LINK TL-WDR5620 version 2.3, as a temporary workaround, consider disabling the `httpProcDataSrv` function until a patch is available. Restrict remote access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers versions prior to 1.0.03.29 **Description** A vulnerability in the web-based management interface of the affected devices could allow an authenticated, remote attacker to execute arbitrary code on an affected device. The attacker must have valid admin credentials to exploit this vulnerability. This issue exists because the web-based management interface does not sufficiently validate user-supplied input, allowing an attacker to send crafted HTTP input to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. **Recommendations** For versions prior to 1.0.03.29, update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the web-based management interface with admin credentials until the issue is resolved. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 4.2.6 build 20230621 QTS versions prior to 4.3.3.2420 build 20230621 QTS versions prior to 4.3.4.2451 build 20230621 QTS versions prior to 4.3.6.2441 build 20230621 **Description** The issue is related to a buffer copy without checking the size of the input, which can allow remote users to execute code via unspecified vectors. This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For QTS versions prior to 4.2.6 build 20230621, update to QTS 4.2.6 build 20230621 or later. For QTS versions prior to 4.3.3.2420 build 20230621, update to QTS 4.3.3.2420 build 20230621 or later. For QTS versions prior to 4.3.4.2451 build 20230621, update to QTS 4.3.4.2451 build 20230621 or later. For QTS versions prior to 4.3.6.2441 build 20230621, update to QTS 4.3.6.2441 build 20230621 or later.

**Name of the Vulnerable Software and Affected Versions** Multimedia Console versions prior to 1.4.7 Multimedia Console versions prior to 2.1.1 **Description** A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. **Recommendations** For Multimedia Console versions prior to 1.4.7, update to version 1.4.7 or later. For Multimedia Console versions prior to 2.1.1, update to version 2.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** TP-Link TL-WDR7660 version 2.0.30 **Description** An issue was discovered in the function httpProcDataSrv that allows attackers to execute arbitrary code. **Recommendations** For TP-Link TL-WDR7660 version 2.0.30, consider disabling the httpProcDataSrv function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.