Roberto Paleari

**Name of the Vulnerable Software and Affected Versions** NETGEAR DGN1000 versions prior to 1.1.00.48 **Description** The NETGEAR DGN1000 router contains a flaw that allows bypassing the authentication process through the use of an alternative path or channel. Exploitation of this issue enables a remote, unauthenticated attacker to execute arbitrary operating system commands as root by sending specially crafted HTTP requests to the `setup.cgi` **API Endpoint**. This vulnerability has been actively exploited in the wild since at least 2017, including observed activity by the Shadowserver Foundation on 2025-02-06 UTC. The vulnerability allows attackers to interact with the router’s backend services without credentials by utilizing URLs containing the “currentsetting.htm” substring. **Recommendations** For NETGEAR DGN1000 versions prior to 1.1.00.48, update the firmware to version 1.1.00.48 or later.

Name of the Vulnerable Software and Affected Versions: Netgear WNR1000v3 versions prior to 1.0.2.60 Description: The issue concerns an authentication bypass via the `NtgrBak` key. This allows unauthorized access, potentially leading to further exploitation. Recommendations: For versions prior to 1.0.2.60, update the firmware to version 1.0.2.60 or later to resolve the issue. As a temporary workaround, consider restricting access to the router until the update can be applied.

Name of the Vulnerable Software and Affected Versions: Netgear WNR1000v3 versions prior to 1.0.2.60 Description: The issue is related to an Authentication Bypass in the Netgear WNR1000v3 router. This occurs because the server skips checks for URLs containing a ".jpg". There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. Recommendations: For versions prior to 1.0.2.60, update the firmware to version 1.0.2.60 or later to resolve the issue. As a temporary workaround, consider restricting access to URLs containing a ".jpg" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Samsung SM-G920F versions G920FXXU2COH2 Samsung SM-N9005 versions N9005XXUGBOK6 Samsung GT-I9192 versions I9192XXUBNB1 Samsung GT-I9195 versions I9195XXUCOL1 Samsung GT-I9505 versions I9505XXUHOJ2 **Description** The issue allows an attacker to access the modem in USB configuration number 2 while the device is in a secure lockscreen state. This unintended availability enables the attacker to make phone calls, send text messages, or issue commands. **Recommendations** For Samsung SM-G920F version G920FXXU2COH2, update to a version that fixes the issue. For Samsung SM-N9005 version N9005XXUGBOK6, update to a version that fixes the issue. For Samsung GT-I9192 version I9192XXUBNB1, update to a version that fixes the issue. For Samsung GT-I9195 version I9195XXUCOL1, update to a version that fixes the issue. For Samsung GT-I9505 version I9505XXUHOJ2, update to a version that fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung kernel for Android versions on SM-N9005 build N9005XXUGBOB6 and SM-G920F build G920FXXU2COH2 **Description** The issue allows attackers to bypass URL filtering by inserting an exceptional URL in the query string. For example, the URL 'http://should-have-been-filtered.example.com/?http://google.com' can be used to bypass filtering. **Recommendations** For SM-N9005 build N9005XXUGBOB6, update the software to a version that fixes this issue. For SM-G920F build G920FXXU2COH2, update the software to a version that fixes this issue. As a temporary workaround, consider restricting access to URLs that contain query strings with exceptional URLs until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Samsung SM-G920F versions G920FXXU2COH2 Samsung SM-N9005 versions N9005XXUGBOK6 Samsung GT-I9192 versions I9192XXUBNB1 Samsung GT-I9195 versions I9195XXUCOL1 Samsung GT-I9505 versions I9505XXUHOJ2 **Description** The issue allows attackers to modify Android settings by leveraging AT access. This is possible because the devices do not block AT+USBDEBUG and AT+WIFIVALUE. **Recommendations** For Samsung SM-G920F version G920FXXU2COH2, restrict access to AT commands to minimize the risk of exploitation. For Samsung SM-N9005 version N9005XXUGBOK6, avoid using AT+USBDEBUG and AT+WIFIVALUE commands until the issue is resolved. For Samsung GT-I9192 version I9192XXUBNB1, consider disabling AT access as a temporary workaround until a patch is available. For Samsung GT-I9195 version I9195XXUCOL1, restrict the use of AT+WIFIVALUE command to prevent modification of Android settings. For Samsung GT-I9505 version I9505XXUHOJ2, disable AT+USBDEBUG command to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Samsung SM-G920F versions G920FXXU2COH2 Samsung SM-N9005 versions N9005XXUGBOK6 Samsung GT-I9192 versions I9192XXUBNB1 Samsung GT-I9195 versions I9195XXUCOL1 Samsung GT-I9505 versions I9505XXUHOJ2 **Description** The issue allows attackers to send AT commands by plugging the device into a Linux host. **Recommendations** For Samsung SM-G920F version G920FXXU2COH2, update to a newer version that contains a fix for this issue. For Samsung SM-N9005 version N9005XXUGBOK6, update to a newer version that contains a fix for this issue. For Samsung GT-I9192 version I9192XXUBNB1, update to a newer version that contains a fix for this issue. For Samsung GT-I9195 version I9195XXUCOL1, update to a newer version that contains a fix for this issue. For Samsung GT-I9505 version I9505XXUHOJ2, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices **Description** The issue allows attackers to read sent e-mail messages. **Recommendations** For Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Samsung kernel for Android versions on SM-N9005 build N9005XXUGBOB6 and SM-G920F build G920FXXU2COH2 **Description** The issue concerns a NULL pointer dereference that can be triggered via a "GET HTTP/1.1" request. This is related to the getURL function in drivers/secfilter/urlparser.c in secfilter. **Recommendations** For SM-N9005 build N9005XXUGBOB6, consider disabling the getURL function in drivers/secfilter/urlparser.c until a patch is available. For SM-G920F build G920FXXU2COH2, restrict access to the secfilter module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Samsung wssyncmlnps versions before 2015-10-31 **Description** The issue allows directory traversal in a Kies restore. **Recommendations** For versions before 2015-10-31, update to a version released after 2015-10-31 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices **Description** The issue is related to SQL injection. **Recommendations** For Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Web Viewer version 1.0.0.193 **Description** The issue allows remote attackers to discover credentials by reading detailed error messages. **Recommendations** For Web Viewer version 1.0.0.193, consider restricting access to detailed error messages as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Web Viewer version 1.0.0.193 **Description** The issue allows attackers to bypass filesystem encryption via XOR calculations. **Recommendations** For version 1.0.0.193, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Web Viewer version 1.0.0.193 **Description** The issue allows remote attackers to read arbitrary files by sending a request to an unspecified PHP script. **Recommendations** For Web Viewer version 1.0.0.193, consider restricting access to the unspecified PHP script until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Huawei AR routers versions prior to V200R007C00SPC100 Quidway S9300 routers versions prior to V200R009C00 S12700 routers versions prior to V200R008C00SPC500 S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00 S5700 routers versions prior to V200R007C00SPC500 **Description** The issue makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage. Encryption keys are stored in the system, allowing an attacker to implement reverse engineering to obtain the encryption keys. **Recommendations** For Huawei AR routers versions prior to V200R007C00SPC100, update to V200R007C00SPC100 or later. For Quidway S9300 routers versions prior to V200R009C00, update to V200R009C00 or later. For S12700 routers versions prior to V200R008C00SPC500, update to V200R008C00SPC500 or later. For S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00, update to V200R007C00 or later. For S5700 routers versions prior to V200R007C00SPC500, update to V200R007C00SPC500 or later.

**Name of the Vulnerable Software and Affected Versions** Huawei AR routers versions prior to V200R007C00SPC100 Quidway S9300 routers versions prior to V200R009C00 S12700 routers versions prior to V200R008C00SPC500 S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00 S5700 routers versions prior to V200R007C00SPC500 **Description** The issue allows remote authenticated administrators to obtain and decrypt passwords by leveraging the selection of a reversible encryption algorithm. This is caused by improper encryption mechanisms in some Huawei products, where users can choose between reversible or irreversible encryption algorithms to encrypt passwords. If a reversible encryption algorithm is used, an attacker with high administrative privileges can log in to the device, obtain the ciphertext password of a higher-level administrator, and potentially crack it to gain elevated privileges. **Recommendations** For Huawei AR routers versions prior to V200R007C00SPC100, update to V200R007C00SPC100 or later. For Quidway S9300 routers versions prior to V200R009C00, update to V200R009C00 or later. For S12700 routers versions prior to V200R008C00SPC500, update to V200R008C00SPC500 or later. For S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00, update to V200R007C00 or later. For S5700 routers versions prior to V200R007C00SPC500, update to V200R007C00SPC500 or later.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.5 **Description** The issue is related to the Bluetooth subsystem in the operating system, which lacks protection of service data. This allows attackers to obtain sensitive kernel memory-layout information via a crafted app, potentially giving a remote attacker access to protected information. **Recommendations** For versions prior to 10.10.5, update to version 10.10.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of Bluetooth functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.5 **Description** The issue is related to a buffer overflow in the ntfs component, allowing local users to gain privileges or cause a denial of service due to memory corruption. **Recommendations** For versions prior to 10.10.5, update to version 10.10.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.4 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service via a crafted app, specifically due to a problem in the FireWire driver in IOFireWireFamily. **Recommendations** For versions prior to 10.10.4, update to version 10.10.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.4 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption via a crafted app. This is related to the Bluetooth HCI interface implementation. **Recommendations** For versions prior to 10.10.4, update to version 10.10.4 or later to resolve the issue.