Kyungroul Lee

**Name of the Vulnerable Software and Affected Versions** secdiskapp version 1.5.1 **Description** An issue in the management program for NewQ Fingerprint Encryption Super Speed Flash Disk allows attackers to gain escalated privileges via `vsVerifyPassword` and `vsSetFingerPrintPower` functions. **Recommendations** For secdiskapp version 1.5.1, as a temporary workaround, consider disabling the `vsVerifyPassword` and `vsSetFingerPrintPower` functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Parrot Bebop version 4.7.1 **Description** The issue allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To exploit this, an attacker would first need to connect to the device's internal Wi-Fi network, for example, by guessing the password. Then, the attacker would send many DHCP request packets. **Recommendations** For Parrot Bebop version 4.7.1, consider restricting access to the device's internal Wi-Fi network to prevent unauthorized connections, and limit the number of DHCP requests to mitigate the risk of IP address pool exhaustion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Toshiba Storage Security Software version 1.2.0.7413 **Description** The issue is related to an Improper Authentication vulnerability that allows sensitive information to be obtained via the local password authentication module. **Recommendations** For Toshiba Storage Security Software version 1.2.0.7413, consider disabling the local password authentication module until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** wizplat PD065 version 1.19 **Description** An access control issue in the authentication module allows attackers to access sensitive data and cause a Denial of Service (DoS). **Recommendations** For wizplat PD065 version 1.19, consider temporarily restricting access to the authentication module until a patch is available. As a mitigation measure, review and strengthen access controls to prevent unauthorized access to sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DJI Spark version 01.00.0900 **Description** The issue is related to a flaw in the implementation of the Dynamic Host Configuration Protocol (DHCP) in the DJI Spark drone's firmware, which can lead to the exhaustion of the IP address pool due to a security-critical code change. This can be exploited by a remote attacker to cause a denial of service by sending specially crafted packets. The exploitation involves connecting to the device's internal Wi-Fi network and then sending multiple DHCP request packets. **Recommendations** For DJI Spark version 01.00.0900, to mitigate this issue, consider restricting access to the device's internal Wi-Fi network and limiting the number of DHCP requests that can be sent to the device. As a temporary workaround, avoid using the DHCP protocol until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lexar F35 version 1.0.34 **Description** An access control issue in the authentication module allows attackers to access sensitive data and cause a Denial of Service (DoS). Attackers can bypass user authentication without having any information related to the password of the registered user. The secure USB flash drive transmits the password entered by the user to the authentication module, which compares the input password with the registered password stored in the module. An attacker can bypass password authentication by analyzing the functions that return the password verification or comparison results and manipulate the authentication result values. This allows attackers to be authenticated as a legitimate user, even with an incorrect password, and exploit functions of the secure USB flash drive. **Recommendations** For Lexar F35 version 1.0.34, as a temporary workaround, consider restricting access to the authentication module until a patch is available. Avoid using the authentication functions that return the password verification or comparison results until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Samsung Drive Manager version 2.0.104 Description: The issue allows attackers to bypass intended access controls on disk management. Functions such as `WideCharToMultiByte`, `WideCharStr`, and `MultiByteStr` can contribute to password exposure. Recommendations: For Samsung Drive Manager version 2.0.104, consider restricting access to the disk management functionality until a patch is available. As a temporary workaround, avoid using the `WideCharToMultiByte`, `WideCharStr`, and `MultiByteStr` functions to minimize the risk of password exposure.

Name of the Vulnerable Software and Affected Versions: DM FingerTool version 1.19 Description: The issue concerns improper authentication in DM FingerTool, allowing local attackers to bypass user authentication through a replay attack. This enables access to all features and data on the USB. Recommendations: For DM FingerTool version 1.19, consider disabling the authentication mechanism temporarily until a patch is available to prevent exploitation. Restrict access to the USB device to minimize the risk of unauthorized data access.