Harry Sintonen

**Name of the Vulnerable Software and Affected Versions** Eaton CLI (affected versions not specified) **Description** An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the command-line interface (CLI). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eaton (affected versions not specified) **Description** The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented, potentially allowing an attacker to perform a Man-in-the-middle attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: cloud-init versions through 25.1.2 Description: The issue concerns the systemd socket unit `cloud-init-hotplugd.socket` in cloud-init, which has a default `SocketMode` that grants 0666 permissions, making it world-writable. This affects the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could potentially trigger hotplug-hook commands. Recommendations: For cloud-init versions through 25.1.2, consider restricting the permissions of the `cloud-init-hotplugd.socket` to prevent unauthorized access. As a temporary workaround, restrict access to the `/run/cloud-init/hook-hotplug-cmd` FIFO to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libssh (affected versions not specified) **Description** The libssh software contains a flaw related to a global knownhost override. This issue could potentially allow an attacker to bypass host key verification, potentially leading to man-in-the-middle attacks. The issue involves the way libssh handles known hosts, allowing for a global override of host key checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A key passphrase bypass is present in libssh when an agent is not set. This issue was discovered through analysis using curl. The potential impact is currently unknown. The vulnerability affects curl in Debian Linux. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: curl versions 6.5 through 8.11.0 Description: The issue arises when curl is used with a `.netrc` file for credentials and follows HTTP redirects. Under certain circumstances, curl could leak the password used for the first host to the followed-to host. This flaw only manifests itself if the `.netrc` file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Recommendations: For versions 6.5 through 8.11.0, upgrade to version 8.11.1 or later to mitigate the risk of credential leakage. As a temporary workaround, consider avoiding the use of `.netrc` files with curl or restricting access to sensitive information when following HTTP redirects.

**Name of the Vulnerable Software and Affected Versions** curl versions prior to 8.1.0 **Description** A denial of service issue exists in the way libcurl provides several different backends for resolving host names. If libcurl is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. This can cause a multi-threaded application to crash or misbehave due to a global buffer that is not mutex protected. The issue can be exploited by a remote attacker to cause a denial of service. **Recommendations** For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the synchronous resolver backend in multi-threaded applications until a patch is available. Restrict access to the vulnerable `alarm()` and `siglongjmp()` functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** curl versions prior to 8.0 **Description** A vulnerability in input validation exists in curl during communication using the TELNET protocol, which may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. **Recommendations** For versions prior to 8.0, update to version 8.0 or later to resolve the issue. As a temporary workaround, consider restricting user input for TELNET protocol negotiations to minimize the risk of exploitation. Avoid using the `username` and `telnet options` variables in the affected API endpoint until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** curl versions prior to 8.0.0 **Description** A path traversal vulnerability exists in the SFTP implementation of curl, where the tilde (~) character is wrongly replaced when used as a prefix in the first path element. This flaw can be exploited by attackers to bypass filtering or execute arbitrary code by crafting a path like `/~2/foo` while accessing a server with a specific user. The vulnerability allows for the circumvention of filtering or worse. **Recommendations** For versions prior to 8.0.0, consider disabling the SFTP implementation until a patch is available. As a temporary workaround, avoid using the tilde (~) character as a prefix in the first path element when accessing servers via SFTP. Restrict access to SFTP servers to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libcurl versions prior to 8.0.0 **Description** An authentication bypass issue exists in the connection reuse feature of libcurl, affecting krb5/kerberos/negotiate/GSSAPI transfers. This is due to a failure to check for changes in the `CURLOPT GSSAPI DELEGATION` option, potentially resulting in unauthorized access to sensitive information. The issue allows previously established connections to be reused with incorrect user permissions. **Recommendations** For libcurl versions prior to 8.0.0, the safest option is to not reuse connections if the `CURLOPT GSSAPI DELEGATION` option has been changed. As a temporary workaround, consider disabling connection reuse until a patch is available. Restrict access to krb5/kerberos/negotiate/GSSAPI transfers to minimize the risk of exploitation. Avoid using the `CURLOPT GSSAPI DELEGATION` option in affected transfers until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 2.3.4 **Description** The issue is related to an insecure umask configuration in Apache Airflow when running with the `--daemon` flag. This could lead to a race condition, resulting in world-writable files in the Airflow home directory. Local users could exploit this to expose arbitrary file contents via the webserver. **Recommendations** For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. As a temporary workaround, consider running Airflow without the `--daemon` flag until the update is applied. Restrict access to the Airflow home directory to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** curl versions 7.65.0 through 7.82.0 **Description** The issue is related to the implementation of the configuration matching function in the curl utility, which does not properly handle IPv6 address zone IDs. This can lead to incorrect connections being made when one transfer uses a zone ID and a subsequent transfer uses a different (or no) zone ID. The vulnerability allows a remote attacker to potentially reuse a connection, leading to information disclosure. **Recommendations** For curl versions 7.65.0 through 7.82.0, update to a version that fixes the issue with the configuration matching function to prevent incorrect connections and potential information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl versions prior to 7.83.0 **Description** The issue is related to a insufficiently protected credentials vulnerability that may leak authentication or cookie header data on HTTP redirects to the same host but another port number. This could allow a remote attacker to incorrectly send the same set of headers to hosts that are identical to the first one but use a different port number or URL scheme. The vulnerability affects applications that pass on custom `Authorization:` or `Cookie:` headers, which often contain sensitive information. **Recommendations** For versions prior to 7.83.0, update to curl 7.83.0 to fix the vulnerability. As a temporary workaround, consider using options that allow users to opt out from the flawed check, but note that this is not set by default. Restrict access to sensitive information and avoid using custom `Authorization:` or `Cookie:` headers in HTTP requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** curl versions 4.9 through 7.82.0 **Description** The issue is related to the handling of HTTP(S) redirects during the authentication process in the cURL utility. When cURL follows redirects, it may leak credentials to other services on different protocols or port numbers. This could allow a remote attacker to gain unauthorized access to protected information. The problem arises because cURL's "same host check" is flawed, failing to consider cross-protocol redirects and different port numbers as separate hosts. **Recommendations** For curl versions 4.9 through 7.82.0, consider disabling the ability to follow HTTP(S) redirects when using authentication to minimize the risk of credential leakage. Restrict access to sensitive information by limiting the use of cURL with authentication to only necessary cases. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foscam C2 versions System Firmware 1.11.1.8 and Application Firmware 2.72.1.32 Opticam i5 versions System Firmware 1.5.2.11 and Application Firmware 2.21.1.128 **Description** An issue allows local users to replace an archive file within the `/mnt/mtd/app` directory, which has `0777` permissions, to control what is extracted to RAM at boot time. **Recommendations** For Foscam C2 with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, consider changing the permissions of the `/mnt/mtd/app` directory to prevent local users from replacing archive files. For Opticam i5 with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128, consider changing the permissions of the `/mnt/mtd/app` directory to prevent local users from replacing archive files.

**Name of the Vulnerable Software and Affected Versions** Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128 **Description** An issue in the firewall feature of the affected devices makes it easier for remote attackers to ascertain credentials and firewall rules. This is because the device returns different error codes for invalid credentials (error -2) and rule-based blocking (error -8), potentially allowing attackers to deduce the presence of specific rules or credentials. **Recommendations** For Foscam C2 version 1.11.1.8, consider disabling the firewall feature until a patch is available. For Foscam C2 Application Firmware version 2.72.1.32, restrict access to the device to minimize the risk of exploitation. For Opticam i5 version 1.5.2.11, avoid using the firewall feature in its current state to prevent potential credential exposure. For Opticam i5 Application Firmware version 2.21.1.128, limit remote access to reduce the risk of attackers exploiting the issue.

**Name of the Vulnerable Software and Affected Versions** Foscam C2 versions 1.11.1.8 Opticam i5 versions 1.5.2.11 **Description** An issue was discovered that makes it easier for attackers to conduct brute-force authentication attacks. The FTP and RTSP services do not have failed-authentication limits, unlike HTTP, which makes them more susceptible to such attacks. **Recommendations** For Foscam C2 version 1.11.1.8, consider restricting access to the FTP and RTSP services until a patch is available. For Opticam i5 version 1.5.2.11, consider restricting access to the FTP and RTSP services until a patch is available. As a temporary workaround, consider implementing additional authentication measures, such as IP blocking or rate limiting, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128 **Description** An issue was discovered that allows unauthenticated persistent XSS through the ONVIF devicemgmt SetHostname method. **Recommendations** For Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128, consider disabling the ONVIF devicemgmt SetHostname method until a patch is available to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128 **Description** A remote stack-based buffer overflow issue was discovered, allowing attackers to conduct attacks via the `IPv4Address` field in the ONVIF devicemgmt `SetDNS` method. **Recommendations** For Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128, consider restricting access to the ONVIF devicemgmt `SetDNS` method until a patch is available. Avoid using the `IPv4Address` field in the affected method to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128 **Description** An issue was discovered that allows local users to control the commands executed at system start-up due to the `/mnt/mtd/boot.sh` file having 0777 permissions. **Recommendations** For Foscam C2 version 1.11.1.8, change the permissions of the `/mnt/mtd/boot.sh` file to prevent local users from modifying it. For Foscam C2 Application Firmware version 2.72.1.32, update the firmware to a version that sets proper permissions for the `/mnt/mtd/boot.sh` file. For Opticam i5 version 1.5.2.11, change the permissions of the `/mnt/mtd/boot.sh` file to prevent local users from modifying it. For Opticam i5 Application Firmware version 2.21.1.128, update the firmware to a version that sets proper permissions for the `/mnt/mtd/boot.sh` file.