Jeremy Johnson

**Name of the Vulnerable Software and Affected Versions** Cohu 3960HD (affected versions not specified) **Description** The issue allows information disclosure through directory listing, enabling an attacker to view and download sensitive device information, including source code and log files. This can be achieved by sending a specially crafted web request, such as a "GET // HTTP/1.1" request, which includes an extra / character. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cohu 3960HD (affected versions not specified) **Description** The issue concerns missing authentication for the remote configuration port 1236/tcp, allowing an attacker to modify configuration parameters, including IP address and username/password, by sending specially crafted XML SOAP packets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cohu 3960 (affected versions not specified) **Description** The issue allows for information disclosure of .esp source code, enabling an attacker to view sensitive information, such as application logic, using a simple web browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cohu 3960HD (affected versions not specified) **Description** The issue is related to the client-side enforcement of server-side security options using JavaScript on the Cohu 3960HD camera. This allows an attacker to manipulate options sent to the camera, potentially causing malfunction or code execution. The vulnerability is associated with the implementation of security functions on the client-side, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service by manipulating camera parameters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cohu 3960HD (affected versions not specified) **Description** The issue concerns the webupgrade function, which does not properly verify firmware upgrade files or the upgrade process. This allows an attacker to upload a specially crafted postinstall.sh file that will be executed with root privileges. The vulnerability is related to unrestricted file upload of dangerous types, enabling a remote attacker to execute arbitrary code with root privileges by uploading a specially formed archive containing the postinstall.sh file. **Recommendations** As a temporary workaround, consider disabling the webupgrade function until a patch is available. Restrict access to the Cohu 3960HD to minimize the risk of exploitation. Avoid using the webupgrade function to upload firmware until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.