Xie Wei

**Name of the Vulnerable Software and Affected Versions** Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers (affected versions not specified) **Description** A vulnerability in the session management functionality of the web-based interface could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The attacker could use this impersonated session to create a new user account or control the device with the privileges of the hijacked session. This is due to a lack of proper session management controls. An attacker could exploit this by sending a crafted HTTP request to a targeted device, allowing them to take control of an existing user session if an authorized user session is active. **Recommendations** For Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers, as a temporary workaround, consider restricting access to the web-based interface until a patch is available. Avoid using the web-based interface for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions 4.3.3 build 20180126 and earlier, QTS 4.3.4 build 20180315 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to unauthorized actions on the affected system. **Recommendations** For QNAP QTS versions 4.3.3 build 20180126 and earlier, update to a version later than 4.3.3 build 20180126. For QTS 4.3.4 build 20180315 and earlier, update to a version later than 4.3.4 build 20180315.