Kelly Patterson

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** Multiple reflected cross-site scripting (XSS) issues exist in the Web Interface / 'ssi.cgi' functionality. A reflected XSS occurs when an application includes untrusted data in a web page without proper validation, allowing an attacker to execute malicious scripts in the victim's browser. An attacker can use a specially crafted URL to trigger the execution of arbitrary JavaScript code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GV-VMS version V20 **Description** A stack overflow exists in the WebCam Server component of the video monitoring software. When remote access is enabled, the `gvapi` endpoint utilizes a specific authentication mechanism via an `HTTP Authorization` header, supporting both Basic and Digest modes. The issue occurs because a base64 decoded string, stored in the `b64decoder` variable, is copied into the `Buffer` stack variable without a bound-check. If the decoded string exceeds 256 characters, a stack overflow is triggered. Since the web server is compiled without ASLR (Address Space Layout Randomization), a security technique that randomly arranges the address space positions of key data areas to prevent memory corruption attacks, an attacker can gain full code execution with SYSTEM privileges on the host machine. **Recommendations** Update GV-VMS version V20 to a patched version. Disable the remote access WebCam Server feature to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** The Web Interface functionality contains a flaw where session cookies are guessable. An attacker can use a series of specially crafted HTTP requests to brute-force these cookies, allowing them to bypass the authentication process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-IP Device Utility version 9.0.5 **Description** Insufficient encryption in the Device Authentication functionality allows for the leak of credentials. When the utility sends privileged commands to devices over UDP, the username and password are encrypted using a symmetric key that is also included within the same packet. An attacker on the same local area network can listen to these broadcast messages and decrypt the credentials, potentially gaining full control over the device configuration to change the IP address or reset the device to factory defaults. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-VMS V20 version 20.0.2 **Description** A stack overflow exists in the WebCam Server Login functionality. An unauthenticated attacker can send a specially crafted HTTP request to trigger the issue, potentially leading to arbitrary code execution with SYSTEM privileges. The flaw occurs because the `sscanf()` function is used to split the `Buffer` variable into `username` and `password` variables without limiting the size of the extracted content. If either the `username` or `password` decoded from the authorization string exceeds 40 characters, a stack overflow occurs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-VMS V20 version 20.0.2 **Description** A stack overflow in the WebCam Server Login functionality allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted HTTP request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** An OS command injection flaw exists in the 'DdnsSetting.cgi' functionality. A specially crafted DDNS configuration allows an attacker to modify a configuration value to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** Multiple reflected cross-site scripting (XSS) issues exist in the Web Interface / 'ssi.cgi' functionality. A reflected XSS occurs when an application includes untrusted data in a web page without proper validation, allowing an attacker to execute malicious scripts in the victim's browser. In this case, a specially crafted URL, specifically through the error message generated when requesting a non-existing page, can lead to arbitrary JavaScript code execution. **Recommendations** As a temporary workaround, restrict access to the 'ssi.cgi' functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** A privilege escalation issue exists in the Web Interface functionality. A specially crafted HTTP request allows an attacker to execute privileged operations by visiting a specific webpage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision LPC2011/LPC2211 version 1.10 **Description** A privilege escalation issue exists in the Web Interface functionality, specifically within the 'ssi.cgi' endpoint. A specially crafted HTTP request can lead to the leak of Administrator credentials, which an attacker can trigger by visiting a webpage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GeoVision GV-IP Device Utility version 9.0.5 **Description** Insufficient encryption in the Device Authentication functionality allows for the leakage of administrator credentials. When the utility sends privileged commands to devices over UDP broadcast, it uses a cryptographic protocol derived from Blowfish. However, the symmetric key required for decryption is included within the same packet, meaning security relies solely on the obscurity of the encryption scheme. An attacker on the same local area network (LAN) can capture these broadcast packets and decrypt the credentials to gain full control over the device configuration, enabling actions such as changing the IP address or performing a factory reset. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A cleartext transmission issue exists in the WEBVIEW-M functionality. A crafted HTTP request can result in sensitive information being disclosed. An attacker can capture network traffic to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A cross-site request forgery issue exists within the WEBVIEW-M functionality. A malicious webpage can be used to trigger this issue by sending a specially crafted HTTP request, potentially leading to unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socomec Easy Config System version 2.6.1.0 **Description** An authentication bypass exists in the User profile management functionality. A crafted database record can allow unauthorized access. An attacker can modify a local database to trigger this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FileX versions prior to 6.4.2 **Description** The FileX RAM disk driver, a component of the Eclipse Foundation ThreadX file support module, contains a possible buffer overflow. This issue can lead to remote execution when processing crafted network packets. **Recommendations** Update FileX to version 6.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A denial of service issue exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality. An unauthenticated attacker can send a crafted network packet to trigger this issue, leading to a denial of service. The vulnerability is specific to messages sent via Modbus TCP over port `502`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A denial of service condition can occur due to specially crafted network requests targeting the Modbus TCP and Modbus RTU over TCP functionality. An attacker can trigger this by sending unauthenticated packets. Specifically, sending a Modbus TCP message to port 503 using the Write Single Register function code (6) to write the value 1 to register 4352 changes the Modbus address to 15, resulting in a denial-of-service state. **Recommendations** For Socomec DIRIS Digiware M-70 version 1.6.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A denial of service condition can occur in the Modbus TCP and Modbus RTU over TCP functionality. An attacker can trigger this by sending a sequence of unauthenticated network packets. Specifically, the attack involves sending a series of Modbus TCP messages to port 502 using the `Write Single Register` function code (6). The sequence starts with a message to register 58112 with a value of 1000, followed by a message to register 29440 with a value representing a new Modbus address. The attack concludes with a message to register 57856 with a value of 161, which commits a configuration change and results in a denial-of-service state. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A denial of service condition can occur in the Modbus TCP and Modbus RTU over TCP functionality. An attacker can trigger this by sending a sequence of unauthenticated network packets. Specifically, the attack involves sending a series of Modbus RTU over TCP messages to port 503, utilizing the Write Single Register function code (6). The sequence starts with a message to register 58112 with a value of 1000, followed by a message to register 29440 with a value representing a new Modbus address. The attack concludes with a message to register 57856 with a value of 161, committing a configuration change that results in a denial-of-service state. **Recommendations** Versions prior to 1.6.9 are not affected. Update Socomec DIRIS Digiware M-70 to a newer version to address this issue.

**Name of the Vulnerable Software and Affected Versions** Socomec DIRIS Digiware M-70 version 1.6.9 **Description** A denial of service condition can occur in the Modbus TCP and Modbus RTU over TCP functionality. An attacker can trigger this by sending a sequence of unauthenticated network packets. Specifically, sending a Modbus TCP message to port 502 using the Write Single Register function code (6) to write the value 1 to register 4352 changes the Modbus address to 15, resulting in a denial-of-service state. **Recommendations** Versions prior to 1.6.9 are not affected.