Yifeng Li

**Name of the Vulnerable Software and Affected Versions** H3C Magic R300 version R300-2100MV100R004 **Description** A stack overflow issue was discovered in the DelvsList interface at the "/goform/aspForm" API endpoint. This issue can be exploited, potentially allowing unauthorized access or control. **Recommendations** For H3C Magic R300 version R300-2100MV100R004, consider restricting access to the "/goform/aspForm" API endpoint until a patch is available. As a temporary workaround, disabling the DelvsList interface may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** H3C Magic R300 version R300-2100MV100R004 **Description** A stack overflow issue was discovered via the "EdittriggerList" interface at the "/goform/aspForm" API endpoint. **Recommendations** For H3C Magic R300 version R300-2100MV100R004, consider restricting access to the "/goform/aspForm" API endpoint until a patch is available. As a temporary workaround, avoid using the EdittriggerList interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** H3C Magic R300 version R300-2100MV100R004 **Description** A stack overflow issue was discovered via the `ipqos lanip dellist` interface at the "/goform/aspForm" API endpoint. **Recommendations** For H3C Magic R300 version R300-2100MV100R004, as a temporary workaround, consider restricting access to the `/goform/aspForm` API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** H3C Magic R300 version R300-2100MV100R004 **Description** A stack overflow issue was discovered via the EditvsList interface at the "/goform/aspForm" API endpoint. This issue affects the specified version of the H3C Magic R300. **Recommendations** For H3C Magic R300 version R300-2100MV100R004, consider disabling access to the "/goform/aspForm" API endpoint until a patch is available. Restricting the use of the EditvsList interface can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** A buffer overflow issue was discovered via the `indexSet` parameter in the `formIPMacBindDel` function. This issue can be exploited, potentially leading to unauthorized access or control. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), as a temporary workaround, consider restricting access to the `formIPMacBindDel` function until a patch is available. Avoid using the `indexSet` parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 version DIR882A1 FW130B06 D-Link DIR-878 version DIR 878 FW1.30B08 **Description** A stack overflow issue was discovered via the `Password` parameter in the SetWan2Settings module. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, avoid using the `Password` parameter in the SetWan2Settings module until the issue is resolved. For D-Link DIR-878 version DIR 878 FW1.30B08, avoid using the `Password` parameter in the SetWan2Settings module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 version DIR882A1 FW130B06 D-Link DIR-878 version DIR 878 FW1.30B08 **Description** A stack overflow issue was discovered via the `Password` parameter in the SetWanSettings module. This issue affects the specified D-Link router models. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, avoid using the `Password` parameter in the SetWanSettings module until a patch is available. For D-Link DIR-878 version DIR 878 FW1.30B08, consider restricting access to the SetWanSettings module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 versions DIR882A1 FW130B06 D-Link DIR-878 versions DIR 878 FW1.30B08 **Description** The issue is related to a buffer overflow in the SetWLanRadioSecurity module of the D-Link DIR-882 and DIR-878 wireless router firmware. This can be exploited by a remote attacker to execute arbitrary code via a stack overflow, specifically through the `Key` parameter in the SetWLanRadioSecurity module. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, update the firmware to a version that fixes the buffer overflow issue in the SetWLanRadioSecurity module. For D-Link DIR-878 version DIR 878 FW1.30B08, update the firmware to a version that fixes the buffer overflow issue in the SetWLanRadioSecurity module. As a temporary workaround, consider restricting access to the SetWLanRadioSecurity module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 versions DIR882A1 FW130B06 D-Link DIR-878 versions DIR 878 FW1.30B08 **Description** The issue is related to a buffer overflow in the SetQuickVPNSettings module of the D-Link DIR-882 and DIR-878 wireless router firmware. This can be exploited by a remote attacker to execute arbitrary code via a stack overflow, specifically through the `PSK` parameter in the SetQuickVPNSettings module. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, update the firmware to a version that fixes the buffer overflow issue in the SetQuickVPNSettings module. For D-Link DIR-878 version DIR 878 FW1.30B08, update the firmware to a version that fixes the buffer overflow issue in the SetQuickVPNSettings module. As a temporary workaround, consider restricting access to the SetQuickVPNSettings module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 versions DIR882A1 FW130B06 D-Link DIR-878 versions DIR 878 FW1.30B08 **Description** The issue is related to a buffer overflow in the SetWan3Settings module of the D-Link DIR-882 and DIR-878 wireless router firmware. This can be exploited by a remote attacker to execute arbitrary code via a stack overflow, specifically through the `Password` parameter in the SetWan3Settings module. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, update the firmware to a version that fixes the buffer overflow issue in the SetWan3Settings module. For D-Link DIR-878 version DIR 878 FW1.30B08, update the firmware to a version that fixes the buffer overflow issue in the SetWan3Settings module. As a temporary workaround, consider restricting access to the SetWan3Settings module until a patch is available. Avoid using the `Password` parameter in the SetWan3Settings module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 version DIR882A1 FW130B06 D-Link DIR-878 version DIR 878 FW1.30B08 **Description** A stack overflow issue was discovered in the SetQuickVPNSettings module of the D-Link DIR-882 and DIR-878 wireless routers, related to the `Password` parameter. This issue can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, consider disabling the SetQuickVPNSettings module until a patch is available. For D-Link DIR-878 version DIR 878 FW1.30B08, restrict access to the SetQuickVPNSettings module to minimize the risk of exploitation. Avoid using the `Password` parameter in the affected module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 versions DIR882A1 FW130B06 D-Link DIR-878 versions DIR 878 FW1.30B08 **Description** The issue is related to a buffer overflow in the SetDynamicDNSSettings module of the D-Link DIR-882 and DIR-878 wireless router firmware. This can be exploited by a remote attacker to execute arbitrary code. The vulnerability is specifically tied to a stack overflow via the `Password` parameter in the SetDynamicDNSSettings module. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, update the firmware to a version that fixes the buffer overflow issue in the SetDynamicDNSSettings module. For D-Link DIR-878 version DIR 878 FW1.30B08, update the firmware to a version that fixes the buffer overflow issue in the SetDynamicDNSSettings module. As a temporary workaround, consider restricting access to the SetDynamicDNSSettings module until a patch is available. Avoid using the `Password` parameter in the SetDynamicDNSSettings module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-882 versions DIR882A1 FW130B06 D-Link DIR-878 versions DIR 878 FW1.30B08 **Description** The issue is related to a buffer overflow in the SetSysEmailSettings module of the D-Link DIR-882 and DIR-878 wireless router firmware. This can be exploited by a remote attacker to execute arbitrary code. The vulnerability is specifically tied to the `AccountPassword` parameter in the SetSysEmailSettings module. **Recommendations** For D-Link DIR-882 version DIR882A1 FW130B06, update the firmware to a version that fixes the buffer overflow issue in the SetSysEmailSettings module. For D-Link DIR-878 version DIR 878 FW1.30B08, update the firmware to a version that fixes the buffer overflow issue in the SetSysEmailSettings module. As a temporary workaround, consider restricting access to the SetSysEmailSettings module until a patch is available. Avoid using the `AccountPassword` parameter in the affected module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** A buffer overflow issue was discovered in the formSetNetCheckTools function via the `hostname` parameter. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), consider restricting access to the formSetNetCheckTools function until a patch is available. Avoid using the `hostname` parameter in the affected function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** A buffer overflow issue was discovered via the `rules` parameter in the `formAddDnsHijack` function. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), consider restricting access to the `formAddDnsHijack` function until a patch is available. Avoid using the `rules` parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** A buffer overflow issue was discovered via the `sPortMapIndex` parameter in the `formDelPortMapping` function. This issue can potentially be exploited, although specific details about the number of affected devices or real-world incidents are not provided. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), consider restricting access to the `formDelPortMapping` function until a patch is available. As a temporary workaround, avoid using the `sPortMapIndex` parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** The issue concerns multiple command injection vulnerabilities. These vulnerabilities can be exploited via the `pEnable`, `pLevel`, and `pModule` parameters in the `formSetDebugCfg` function. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), as a temporary workaround, consider disabling the `formSetDebugCfg` function until a patch is available. Restrict access to the parameters `pEnable`, `pLevel`, and `pModule` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** The issue is related to multiple buffer overflows that can occur via the `pEnable`, `pLevel`, and `pModule` parameters in the `formSetDebugCfg` function. This can potentially allow for exploitation. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), as a temporary workaround, consider disabling the `formSetDebugCfg` function until a patch is available. Restrict access to the parameters `pEnable`, `pLevel`, and `pModule` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** A command injection issue was found via the `hostname` parameter in the `formSetNetCheckTools` function. This allows for potential command injection attacks. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), as a temporary workaround, consider restricting access to the `formSetNetCheckTools` function until a patch is available. Avoid using the `hostname` parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** IP-COM M50 version 15.11.0.33(10768) **Description** A buffer overflow issue was discovered via the `rules` parameter in the `formAddDnsForward` function. This issue can be exploited, potentially leading to unintended consequences. **Recommendations** For IP-COM M50 version 15.11.0.33(10768), as a temporary workaround, consider restricting access to the `formAddDnsForward` function until a patch is available. Avoid using the `rules` parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.