Todor Donev

**Name of the Vulnerable Software and Affected Versions** Hisilicon HiIpcam version V100R003 **Description** The software contains a directory traversal flaw that allows unauthenticated attackers to access sensitive configuration files. This is achieved by exploiting directory listing within the `cgi-bin` directory. Attackers can request the ''getadslattr.cgi'' endpoint to retrieve ADSL credentials and network configuration parameters, including usernames, passwords, and DNS settings. **Recommendations** Apply a fix for Hisilicon HiIpcam version V100R003.

**Name of the Vulnerable Software and Affected Versions** IntelBras Telefone IP TIP200 and 200 LITE (affected versions not specified) **Description** The IntelBras Telefone IP TIP200 and 200 LITE devices have an issue allowing unauthorized reading of arbitrary files. This is due to a flaw in the `dumpConfigFile()` function, which is accessible through the `cgiServer.exx` endpoint. An attacker can exploit this by sending GET requests to the `/cgi-bin/cgiServer.exx` API endpoint with the `command` parameter set to `dumpConfigFile()`. This allows the attacker to read sensitive files, such as `/etc/shadow` and configuration files, without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ACE Security WiP-90113 HD Camera (affected versions not specified) **Description** An unauthenticated attacker can retrieve sensitive configuration files from the camera. Accessing the camera’s configuration backup is possible by sending a GET request to the `/config backup.bin` endpoint, which exposes credentials and system settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DBPower C300 HD Camera (affected versions not specified) **Description** The DBPower C300 HD Camera has a configuration disclosure issue. Unauthenticated attackers can obtain sensitive credentials by accessing an unprotected configuration backup endpoint. Specifically, attackers can download the configuration file and extract hardcoded username and password from the `/tmpfs/config backup.bin` resource. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ACE SECURITY WIP-90113 HD cameras (affected versions not specified) **Description** ACE SECURITY WIP-90113 HD cameras have an issue where configuration information can be disclosed without authentication. The `/web/cgi-bin/hi3510/backup.cgi` API endpoint allows remote download of a compressed configuration backup without requiring any authentication or authorization. This backup may contain administrative credentials and other sensitive device settings. An unauthenticated remote attacker could obtain this information, potentially leading to further compromise of the camera or the connected network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ESCAM QD-900 WIFI HD cameras (affected versions not specified) **Description** ESCAM QD-900 WIFI HD cameras have an unauthenticated configuration disclosure issue in the `/web/cgi-bin/hi3510/backup.cgi` endpoint. This endpoint allows remote download of a compressed configuration backup without authentication or authorization. The exposed backup may contain administrative credentials and other sensitive device settings, potentially enabling an unauthenticated remote attacker to gain information that could compromise the camera or connected network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dongyoung Media DM-AP240T/W (affected versions not specified) **Description** Dongyoung Media DM-AP240T/W wireless access points have an issue where the `/cgi-bin/sys system config` API endpoint allows remote retrieval of a configuration archive without authentication. This allows an attacker to obtain administrative credentials and other sensitive settings, potentially leading to further compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tellion HN-2204AP routers (affected versions not specified) **Description** Tellion HN-2204AP routers have an issue where the `/cgi-bin/system config file` management endpoint allows remote retrieval of a compressed configuration archive without authentication or authorization. The exposed configuration may contain administrative credentials, wireless keys, and other sensitive settings. This could allow an unauthenticated attacker to obtain information that could facilitate further compromise of the device or network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Astak CM-818T3 2.4GHz wireless security surveillance cameras (affected versions not specified) **Description** The Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure issue. The `/web/cgi-bin/hi3510/backup.cgi` API endpoint allows remote download of a compressed configuration backup without authentication or authorization. The exposed backup may contain administrative credentials and other sensitive device settings, potentially enabling an unauthenticated remote attacker to gain information that could compromise the camera or connected network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PLANEX CS-QP50F-ING2 smart cameras (affected versions not specified) **Description** The PLANEX CS-QP50F-ING2 smart cameras have a configuration backup interface accessible over HTTP without authentication. An unauthenticated remote attacker can retrieve a compressed configuration backup file directly from the device. This backup file contains sensitive configuration information, including credentials, potentially granting the attacker administrative access to the camera and compromising the monitored environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2730U version IN 1.02 D-Link DSL-2750U version SEA 1.04 D-Link DSL-2750E version SEA 1.07 Description: A path traversal vulnerability exists in the web management interface of D-Link ADSL routers due to insufficient input validation on the `getpage` parameter within the "/cgi-bin/webproc" CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device. Recommendations: For D-Link DSL-2730U version IN 1.02, consider disabling the `/cgi-bin/webproc` CGI script until a patch is available. For D-Link DSL-2750U version SEA 1.04, restrict access to the `getpage` parameter to minimize the risk of exploitation. For D-Link DSL-2750E version SEA 1.07, avoid using the `getpage` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Enigma2 Webinterface versions 1.6.0 through 1.6.8 Enigma2 Webinterface version 1.6rc3 Enigma2 Webinterface version 1.7.0 **Description** The issue allows remote attackers to read arbitrary files via a full pathname in the `file` parameter. This is an absolute path traversal vulnerability in a file in the Enigma2 Webinterface. **Recommendations** For Enigma2 Webinterface versions 1.6.0 through 1.6.8, consider restricting access to the file parameter to minimize the risk of exploitation. For Enigma2 Webinterface version 1.6rc3, avoid using the `file` parameter with full pathnames until the issue is resolved. For Enigma2 Webinterface version 1.7.0, restrict access to the vulnerable file to prevent arbitrary file reading.

**Name of the Vulnerable Software and Affected Versions** DreamBox DM800 versions 1.6rc3, 1.5rc1, and earlier **Description** A directory traversal issue exists in the file component, allowing remote attackers to read arbitrary files by manipulating the `file` parameter. **Recommendations** For DreamBox DM800 versions 1.6rc3, 1.5rc1, and earlier, consider restricting access to the file component until a fix is available. Avoid using the `file` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.