Pierre Martin

**Name of the Vulnerable Software and Affected Versions** No specific software name or versions are mentioned in the provided descriptions. **Description** An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected product's administration panel to gain read and write access to a specific log file of the device. This allows the attacker to potentially exploit the device further. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) versions prior to 1.3.0.8 **Description** A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. The attacker must have valid administrative credentials for the device to exploit this vulnerability. **Recommendations** For Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) versions prior to 1.3.0.8: Apply network restrictions to protect appliances, as the device has reached end-of-life and no firmware updates will be released to patch this security flaw. Consider disabling remote access to the web-based management interface until further mitigation measures can be applied. Restrict access to the device to minimize the risk of exploitation, as no patch will be available for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.