Taizoh Tsukamoto

**Name of the Vulnerable Software and Affected Versions** NEC Platforms, Ltd. Aterm Series (affected versions not specified) **Description** A missing authorization issue exists in NEC Platforms, Ltd. Aterm Series. This allows an attacker to obtain specific device information and modify settings through a network connection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iND Co.,Ltd products (affected versions not specified) **Description** Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information issue. Exploitation may lead to the disclosure of configuration information, such as admin passwords. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iND Co.,Ltd products (affected versions not specified) **Description** Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. Exploitation may allow an arbitrary OS command to be executed and sensitive information to be obtained. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue is related to an unprotected Windows messaging channel, also known as 'Shatter'. This allows an attacker to send a specially crafted message to a specific process of the Windows system where the product is running, potentially altering arbitrary files in the system. As a result, an arbitrary DLL may be executed with SYSTEM privilege. Recommendations: For Defense Platform Home Edition versions 3.9.51.x and earlier, consider restricting access to the Windows messaging channel to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Defense Platform Home Edition versions 3.9.51.x and earlier **Description** A buffer overflow issue exists, allowing a remote attacker to potentially gain SYSTEM privileges of the Windows system where the product is installed, by performing a specific operation. **Recommendations** For Defense Platform Home Edition versions 3.9.51.x and earlier, consider restricting access to sensitive system resources until a patch is available. As a temporary workaround, limit the product's interaction with the Windows system to minimize the risk of privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue allows an attacker to obtain SYSTEM privilege of the Windows system where the product is running by performing a specific operation. This is due to an execution with unnecessary privileges issue. Recommendations: For Defense Platform Home Edition versions 3.9.51.x and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue exists due to an unprotected Windows messaging channel, also known as 'Shatter'. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege. Recommendations: For Defense Platform Home Edition versions 3.9.51.x and earlier, consider disabling the Windows messaging channel as a temporary workaround until a patch is available. Restrict access to the specific process of the Windows system where the product is running to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Defense Platform Home Edition versions 3.9.51.x and earlier **Description** A NULL pointer dereference issue exists, allowing an attacker to cause a denial-of-service (DoS) condition by providing specially crafted data to a specific process of the Windows system where the product is running. This can result in a Blue Screen of Death (BSOD). **Recommendations** For Defense Platform Home Edition versions 3.9.51.x and earlier, consider temporarily restricting access to the specific process of the Windows system where the product is running to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** QBiC CLOUD CC-2L versions 1.1.30 and earlier Safie One versions 1.8.2 and earlier **Description** The issue is related to improper certificate validation, which may allow a network-adjacent unauthenticated attacker to obtain and/or alter communications of the affected product via a man-in-the-middle attack. **Recommendations** For QBiC CLOUD CC-2L versions 1.1.30 and earlier, update to a version that properly validates certificates. For Safie One versions 1.8.2 and earlier, update to a version that properly validates certificates. As a temporary workaround, consider restricting network access to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N (affected versions not specified) **Description** The issue allows an attacker to obtain specific files in the product due to improper limitation of a pathname to a restricted directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MW WP Form versions v4.4.2 and earlier **Description** A directory traversal vulnerability allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings. **Recommendations** For MW WP Form versions v4.4.2 and earlier, update to a version later than v4.4.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to prevent unauthorized alterations to the website.

**Name of the Vulnerable Software and Affected Versions** Qrio Lock (Q-SL2) versions 2.0.9 and earlier **Description** The issue allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions. This is due to an authentication bypass vulnerability. **Recommendations** For Qrio Lock (Q-SL2) versions 2.0.9 and earlier, update to a version later than 2.0.9 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nintendo Wi-Fi Network Adaptor WAP-001 (affected versions not specified) **Description** The issue allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nintendo Wi-Fi Network Adaptor WAP-001 (affected versions not specified) **Description** A buffer overflow issue allows an attacker with administrative privileges to execute arbitrary code. The attack vector is not specified. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AttacheCase versions 3.6.1.0 and earlier **Description** The issue allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability. **Recommendations** For versions 3.6.1.0 and earlier, update to a version later than 3.6.1.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TEPRA PRO SR5900P versions 1.080 and earlier TEPRA PRO SR-R7900P versions 1.030 and earlier **Description** The issue allows an attacker on the adjacent network to obtain credentials for connecting to the Wi-Fi access point with the infrastructure mode due to insufficiently protected credentials. **Recommendations** For TEPRA PRO SR5900P versions 1.080 and earlier, update to a version later than 1.080 to resolve the issue. For TEPRA PRO SR-R7900P versions 1.030 and earlier, update to a version later than 1.030 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MIRUPASS PW10 firmware all versions MIRUPASS PW20 firmware all versions **Description** The issue concerns a missing encryption of sensitive data, allowing an attacker with physical access to the device to obtain stored passwords. **Recommendations** For MIRUPASS PW10 firmware, consider implementing additional security measures to protect stored passwords until a fix is available. For MIRUPASS PW20 firmware, restrict physical access to the device to minimize the risk of exploitation. As a temporary workaround, consider using alternative password storage methods that provide encryption until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior) ELECOM LAN routers (WRH-733GWH firmware v1.02.9 and prior) Description: The issue allows a network-adjacent attacker with administrator privilege to execute arbitrary OS commands via unspecified vectors. Recommendations: For ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior), update to a version later than v1.02.9. For ELECOM LAN routers (WRH-733GWH firmware v1.02.9 and prior), update to a version later than v1.02.9.

Name of the Vulnerable Software and Affected Versions: ELECOM LAN routers versions 1.02.9 and prior Description: A buffer overflow issue allows a network-adjacent attacker with administrator privileges to execute arbitrary OS commands via unspecified vectors. Recommendations: For versions 1.02.9 and prior, update to a version later than 1.02.9 to resolve the issue. As a temporary workaround, consider restricting administrator access to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: ELECOM LAN routers (WRH-733GBK) versions 1.02.9 and prior ELECOM LAN routers (WRH-733GWH) versions 1.02.9 and prior Description: The issue allows a network-adjacent attacker with administrator privilege to execute arbitrary OS commands via unspecified vectors. Recommendations: For ELECOM LAN routers (WRH-733GBK) versions 1.02.9 and prior, update to a version later than 1.02.9. For ELECOM LAN routers (WRH-733GWH) versions 1.02.9 and prior, update to a version later than 1.02.9.