Patrick Desantis

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 router (affected versions not specified) **Description** The issue concerns a vulnerability within the web application of the router, allowing unauthenticated disclosure of sensitive information. This includes the WiFi WPS PIN, which can be accessed through a hidden page using an HTTP request. Disclosure of this information could enable attackers to connect to the device's WiFi network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 version R0.40e6 **Description** A denial of service issue exists in the Web Application functionality. It can be triggered by a specially crafted HTTP request, leading to a reboot. An attacker can exploit this by sending a crafted HTTP request. **Recommendations** For LevelOne WBR-6012 version R0.40e6, as a temporary workaround, consider restricting access to the Web Application functionality until a patch is available. Avoid using the Web Application functionality in a way that could trigger the denial of service condition. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WBR-6012 (affected versions not specified) **Description** The WBR-6012 is a wireless SOHO router that functions as an internet gateway for homes and small offices. It provides a WiFi access point and serves as a 4-port wired router, implementing common SOHO router capabilities such as port forwarding, quality-of-service, web-based administration, a DHCP server, a basic DMZ, and UPnP capabilities. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 router (affected versions not specified) **Description** The router has an information disclosure issue in its web application, allowing unauthenticated users to access a verbose system log page. This exposes sensitive data, including memory addresses and IP addresses for login attempts, which could lead to session hijacking due to the device's reliance on IP address for authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 version R0.40e6 **Description** The issue is related to an authentication bypass in the web application of the router, which relies on client IP addresses for authentication. This allows attackers to spoof an IP address and gain unauthorized access without needing a session token. **Recommendations** For LevelOne WBR-6012 version R0.40e6, consider restricting access to the web application until a patch is available, and avoid relying solely on client IP addresses for authentication. As a temporary workaround, implement additional authentication measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 version R0.40e6 **Description** A cross-site request forgery (CSRF) issue exists in the Web Application functionality. This allows an attacker to stage a malicious web page that can trigger the vulnerability, leading to unauthorized access through a specially crafted HTTP request. **Recommendations** For LevelOne WBR-6012 version R0.40e6, consider disabling access to the Web Application functionality until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to the router's web interface to minimize the risk of unauthorized access.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 router version R0.40e6 **Description** A vulnerability in the LevelOne WBR-6012 router's firmware allows sensitive information to be transmitted in cleartext via Web and FTP services, exposing it to network sniffing attacks. **Recommendations** For version R0.40e6, consider disabling Web and FTP services until a patch is available to prevent sensitive information from being transmitted in cleartext. Restrict access to the router's network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 router version R0.40e6 **Description** The issue is related to improper resource allocation within the web application of the router. It can be triggered by a series of crafted HTTP requests, leading to a reboot of the device. This could result in network service interruptions. **Recommendations** For LevelOne WBR-6012 router version R0.40e6, consider disabling access to the web application until a fix is available to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 (affected versions not specified) **Description** A security issue exists due to hard-coded credentials in the web services of the affected device. This allows attackers to gain unauthorized access within the first 30 seconds after the device boots. Other vulnerabilities can force the device to reboot, removing the initial time limit for exploitation. The hard-coded password string is referenced by a function and can be used to gain user-level access. The password is compared using the `strcmp` function with the string "AriesSerenaCairryNativitaMegan". Once authenticated, it is possible to manually change the password by exploiting another issue using the HTTP POST parameter `Pu` (new user password). **Recommendations** For LevelOne WBR-6012, as a temporary workaround, consider restricting access to the web services during the first 30 seconds post-boot to minimize the risk of exploitation. Avoid using the default hard-coded password string "AriesSerenaCairryNativitaMegan" for authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 (affected versions not specified) **Description** A security issue exists due to hard-coded credentials in the web services of the affected device. This allows attackers to gain unauthorized access within the first 30 seconds after the device boots. Other vulnerabilities can force the device to reboot, removing the initial time restriction for exploitation. The hard-coded credentials are referenced by a function and used for authentication, as shown in pseudocode. If the password matches the hard-coded string `@m!t2K1` within the specified time frame, it returns a value granting admin-level access. **Recommendations** For LevelOne WBR-6012, as a temporary workaround, consider disabling the web services until a patch is available. Restrict access to the device during the first 30 seconds after boot to minimize the risk of exploitation. Avoid using the default password, and change it as soon as possible after booting the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 router firmware version R0.40e6 **Description** The issue is related to an input validation vulnerability within the FTP functionality, allowing attackers to cause a denial of service through a series of malformed FTP commands. This can lead to device reboots and service disruption. **Recommendations** For LevelOne WBR-6012 router firmware version R0.40e6, consider disabling the FTP functionality as a temporary workaround until a patch is available. Restrict access to the FTP service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LevelOne WBR-6012 router version R0.40e6 **Description** The issue allows attackers to change the administrator password and gain higher privileges without the current password. **Recommendations** For version R0.40e6, update the firmware to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 **Description** A cleartext transmission issue exists in the web application functionality, allowing an attacker to obtain sensitive information by sniffing network traffic. This can lead to unauthorized access to protected information. **Recommendations** For Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1, consider implementing encryption for data transmission to prevent cleartext exposure. As a temporary workaround, restrict access to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 **Description** A denial of service issue exists in the web server functionality due to insufficient resources. Exploitation of this issue can allow a remote attacker to cause a denial of service by sending a specially crafted HTTP request. The vulnerability can be triggered by sending an HTTP request with a specially-crafted HTTP message header. **Recommendations** For Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1, consider restricting access to the web server functionality until a patch is available. As a temporary workaround, avoid using the web server functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 **Description** A stored cross-site scripting issue exists in the web application functionality. This can be triggered by a specially-crafted HTTP request, leading to arbitrary Javascript execution. The vulnerability is related to insufficient protection of the web page structure when handling the Switch Location field in the Switch Information section. An attacker can exploit this by sending a crafted HTTP request. The form field `webLocationMessage text` is specifically mentioned as being involved. **Recommendations** For Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1, consider disabling the web application functionality or restricting access to the Switch Information section until a patch is available. Avoid using the `webLocationMessage text` form field in the affected web application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 **Description** A stored cross-site scripting issue exists in the web application functionality, allowing arbitrary Javascript execution through a specially-crafted HTTP request. The vulnerability is related to insufficient protection of the web page structure when handling the Contact Information field in the Switch Information section. An attacker can exploit this by sending an HTTP request, potentially leading to the execution of arbitrary JavaScript code. The form field `id="switch contact"` is specifically mentioned as being involved in this issue. **Recommendations** For Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1, consider disabling the web application functionality or restricting access to the Switch Information section until a patch is available. As a temporary workaround, avoid using the form field `id="switch contact"` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 **Description** A stored cross-site scripting issue exists in the web application functionality, allowing arbitrary Javascript execution through a specially-crafted HTTP request. The vulnerability is related to insufficient protection of the web page structure when handling the `switch description` field in the Switch Information section. An attacker can exploit this by sending an HTTP request to trigger the issue, potentially leading to the execution of arbitrary JavaScript code. The form field `id="Switch Description"` and `name="switch description"` are specifically implicated. **Recommendations** For Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1, consider disabling the web application functionality or restricting access to the Switch Information section until a patch is available. As a temporary workaround, avoid using the `switch description` field in the affected form until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 **Description** An information disclosure issue exists in the web application functionality, allowing a specially-crafted HTTP request to disclose sensitive information. An attacker can exploit this by sending a crafted HTTP request. The vulnerability is related to insufficient protection of service data when processing URL address symbols `/` or ``. **Recommendations** For Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1, consider restricting access to the web application functionality until a patch is available. As a temporary workaround, avoid using the vulnerable web application functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa MXView version 3.2.4 **Description** The issue is related to the transmission of data in an open manner, which can allow a remote attacker to disclose protected information. An information disclosure vulnerability exists in the Web Application functionality, where network sniffing can lead to the disclosure of sensitive information. An attacker can exploit this vulnerability by sniffing network traffic. **Recommendations** For Moxa MXView version 3.2.4, consider restricting access to sensitive information and network traffic to minimize the risk of exploitation. As a temporary workaround, restrict network access to the Web Application functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa MXView version 3.2.4 **Description** The issue is related to the use of hardcoded credentials in the web interface of Moxa MXView, allowing a remote attacker to gain full access to the device by sending a specially crafted HTTP request. This can lead to unauthorized access. **Recommendations** For Moxa MXView version 3.2.4, consider disabling the web interface functionality until a patch is available to prevent exploitation. Restrict access to the device to minimize the risk of unauthorized access. Avoid using the web application functionality in Moxa MXView until the issue is resolved.