Jiraput Thamsongkrah

**Name of the Vulnerable Software and Affected Versions** HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR **Description** The issue allows an authenticated attacker to inject their own script into the page via the HTTP configuration page, which is a Cross Site Scripting (XSS) problem. This only affects products that are no longer supported by the maintainer. **Recommendations** For HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR, as a temporary workaround, consider restricting access to the HTTP configuration page until a solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 SKYWORTH GN542VF Boa version 0.94.13 Description: The issue is related to the session cookie in an HTTPS session not having the Secure flag set, making it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. Recommendations: For SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16, consider updating the software to a version that sets the Secure flag for the session cookie. For SKYWORTH GN542VF Boa version 0.94.13, consider updating the Boa version to one that properly sets the Secure flag for the session cookie. As a temporary workaround, consider restricting access to sensitive information transmitted over HTTP sessions until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 Description: The issue allows an authenticated attacker to inject their own script into the Configuration page via the DDNS Configuration Section. This is a Cross Site Scripting (XSS) issue. Recommendations: For SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16, consider restricting access to the DDNS Configuration Section until a patch is available. As a temporary workaround, avoid using the Configuration page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: TOTOLINK-A702R-V1.0.0-B20161227.1023 Description: The issue allows an attacker to access `/icons/` directories via a GET parameter. This is related to directory indexing in the login portal. Recommendations: For TOTOLINK-A702R-V1.0.0-B20161227.1023, restrict access to the `/icons/` directory to minimize the risk of exploitation. Avoid using the GET parameter to access sensitive directories until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.