Xiaobye

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions 7.1.14 through 7.2.4 **Description** A difficult to exploit issue exists within the Core component of Oracle VM VirtualBox. A highly privileged attacker with access to the system where Oracle VM VirtualBox is running can compromise the software. Successful exploitation can lead to a takeover of Oracle VM VirtualBox and may significantly impact other products. **Recommendations** Update Oracle VM VirtualBox to a version later than 7.2.4. Update Oracle VM VirtualBox to a version later than 7.1.14.

Name of the Vulnerable Software and Affected Versions: Ameba-AIoT ameba-arduino-d versions prior to 3.1.9 ameba-rtos-d versions prior to commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a Description: A heap-based buffer overflow exists in the WLAN driver defragment function due to a lack of validation of the size of fragmented Wi-Fi frames. Recommendations: Update Ameba-AIoT ameba-arduino-d to version 3.1.9 or later. Update ameba-rtos-d to commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a or later.

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions through 1.7.0 **Description** A Buffer Copy without Checking Size of Input, also known as a 'Classic Buffer Overflow', vulnerability in Apache NimBLE could result in memory corruption when a specially crafted MESH message is used and a non-default build configuration is applied. Users are recommended to upgrade to a newer version to fix the issue. **Recommendations** For Apache NimBLE versions through 1.7.0, upgrade to version 1.8.0, which fixes the issue. As a temporary workaround, consider restricting the use of specially crafted MESH messages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** btstack mesh versions before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 **Description** The issue allows a remote attacker to execute arbitrary code via the `pb adv handle tranaction cont` function in the src/mesh/pb adv.c component. This is a Buffer Overflow vulnerability. **Recommendations** For versions before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58, update to version v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 or later to resolve the issue. As a temporary workaround, consider disabling the `pb adv handle tranaction cont` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer AX21 versions 1.1.4 Build 20230219 through 1.1.4 Build 20230219 **Description** The issue is related to a buffer overflow in the memory of the TP-Link Archer AX21 router's firmware. This can allow a remote attacker to execute arbitrary code. **Recommendations** For versions 1.1.4 Build 20230219, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer AX21 (affected versions not specified) **Description** The issue is caused by a buffer overflow in the tdpServer microprogram of TP-Link Archer AX21 routers. This allows a remote attacker to execute arbitrary code on affected installations. The flaw exists within the logging functionality of the tdpServer program, which listens on UDP port 20002. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Authentication is not required to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.