Rigan

**Name of the Vulnerable Software and Affected Versions** D-Link DCS-900, DCS-2000, and DCS-5300 (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack administrator authentication for requests that change the administrator password via the `rootpass` parameter in the setup/security.cgi endpoint. **Recommendations** For D-Link DCS-900, DCS-2000, and DCS-5300, as a temporary workaround, consider restricting access to the setup/security.cgi endpoint to minimize the risk of exploitation. Avoid using the `rootpass` parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AirTies Air 4450 version 1.1.2.18 **Description** The issue allows remote attackers to cause a denial of service, resulting in a reboot of the device, by sending a direct request to the "cgi-bin/loader" endpoint. **Recommendations** For AirTies Air 4450 version 1.1.2.18, consider restricting access to the "cgi-bin/loader" endpoint to prevent remote attackers from causing a denial of service.