Ilya Shaposhnikov

**Name of the Vulnerable Software and Affected Versions** IQrouter versions 3.3.1 and earlier **Description** The issue allows remote attackers to control the device, enabling actions such as restarting the network, rebooting, upgrading, or resetting, due to incorrect access control. This issue is relevant to brand-new networks, particularly before the initial configuration is completed and a secure password is set. It is also a common issue in unconfigured releases of OpenWRT and other new Linux distributions prior to their first configuration. **Recommendations** For IQrouter versions 3.3.1 and earlier, as a temporary workaround, consider restricting access to the device until a secure password is set during the initial configuration. Ensure that the initial configuration step for setting a secure password on the system is completed to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IQrouter versions through 3.3.1 **Description** The issue allows remote attackers to read system logs due to Incorrect Access Control in the web-panel. This can occur on a brand-new network before the initial configuration is completed, including setting a secure password. It is noted that this condition is also applicable to unconfigured releases of OpenWRT and many other new Linux distributions prior to their first configuration. **Recommendations** For IQrouter versions through 3.3.1, complete the initial configuration and set a secure password to mitigate the risk of system log exposure. As a temporary workaround, consider restricting access to the web-panel until the initial configuration is completed.

**Name of the Vulnerable Software and Affected Versions** IQrouter versions prior to 3.3.1 **Description** The issue is related to Bash Shell Metacharacter Injection, which leads to multiple remote code execution vulnerabilities in the web-panel of IQrouter when it is unconfigured. This issue is not unique to IQrouter and is also present in unconfigured releases of OpenWRT and many other new Linux distributions prior to their initial configuration. **Recommendations** For IQrouter versions prior to 3.3.1, configure the system by setting a secure password to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the web-panel until the system is fully configured.

**Name of the Vulnerable Software and Affected Versions** IQrouter versions 3.3.1 and earlier **Description** The issue allows remote attackers to change the root password arbitrarily using the Lua function `diag set password` in the web-panel. This can occur on a brand-new network that has not been configured with a secure password. **Recommendations** For IQrouter versions 3.3.1 and earlier, consider disabling the `diag set password` function in the web-panel until a secure configuration can be applied, and ensure a secure password is set during the initial configuration to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** IQrouter versions 3.3.1 and earlier **Description** The issue allows attackers to gain full remote access via SSH due to a root user without a password. This can occur on a brand-new network that has not been configured, specifically after initiating the forced initial configuration but before setting a secure password on the system. It is noted that this condition is also true for any unconfigured release of OpenWRT and many other new Linux distributions prior to their first configuration. **Recommendations** For IQrouter versions 3.3.1 and earlier, set a secure password on the system during the initial configuration to prevent unauthorized access. As a temporary workaround, consider disabling remote SSH access until a secure password is set.

**Name of the Vulnerable Software and Affected Versions** IQrouter versions 3.3.1 and earlier **Description** The issue allows remote attackers to change the root password arbitrarily using the Lua function `reset password` in the web-panel. This can occur on a brand-new network that has not been configured with a secure password. It is noted that this behavior is also seen in unconfigured releases of OpenWRT and other new Linux distributions prior to their initial configuration. **Recommendations** For IQrouter versions 3.3.1 and earlier, as a temporary workaround, consider disabling the `reset password` function in the web-panel until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rubetek SmartHome 2020 devices **Description** The issue concerns the use of unencrypted 433 MHz communication between controllers and beacons in Rubetek SmartHome 2020 devices. This allows an attacker to remotely sniff and spoof beacon requests. **Recommendations** For Rubetek SmartHome 2020 devices, consider implementing encryption for the 433 MHz communication between controllers and beacons to prevent sniffing and spoofing of beacon requests.

**Name of the Vulnerable Software and Affected Versions** MicroDigital N-series cameras with firmware through 6400.0.8.5 **Description** The issue is related to a buffer overflow in memory, which can be exploited by an attacker to cause a denial of service. This can be achieved by uploading a file with a filename longer than 256 bytes to the "upload.php" endpoint. The file will be placed in the "updownload" area and will not be deleted due to the buffer overflow in a Bash command string. **Recommendations** For MicroDigital N-series cameras with firmware through 6400.0.8.5, consider restricting access to the "upload.php" endpoint to prevent unauthorized file uploads until a patch is available. As a temporary workaround, limit the length of filenames that can be uploaded to prevent buffer overflow exploitation.

**Name of the Vulnerable Software and Affected Versions** MicroDigital N-series cameras with firmware through 6400.0.8.5 **Description** A CSRF issue was discovered in the HTTPD service, specifically affecting the "webparam?user&action=set&param=add" API endpoint. This issue can be exploited to create an admin account. **Recommendations** For firmware versions through 6400.0.8.5, as a temporary workaround, consider restricting access to the "webparam?user&action=set&param=add" API endpoint until a patch is available. Avoid using the `user` and `action` parameters in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.