Yingmuo

**Name of the Vulnerable Software and Affected Versions** QuNetSwitch versions prior to 2.0.4.0415 **Description** A command injection issue exists in QuNetSwitch. Remote attackers can potentially execute arbitrary commands. **Recommendations** Update to QuNetSwitch version 2.0.4.0415 or later.

**Name of the Vulnerable Software and Affected Versions** QuNetSwitch versions prior to 2.0.5.0906 **Description** A command injection vulnerability exists in QuNetSwitch. A local attacker gaining administrator privileges can exploit this issue to execute arbitrary commands. **Recommendations** Update to QuNetSwitch version 2.0.5.0906 or later.

**Name of the Vulnerable Software and Affected Versions** QuNetSwitch versions prior to 2.0.5.0906 **Description** A command injection issue exists in QuNetSwitch. Successful exploitation allows a remote attacker who has obtained a user account to execute arbitrary commands. **Recommendations** Update to QuNetSwitch version 2.0.5.0906 or later.

**Name of the Vulnerable Software and Affected Versions** QuNetSwitch versions prior to 2.0.5.0906 **Description** A use of hard-coded credentials allows remote attackers to gain unauthorized access. **Recommendations** Update to version 2.0.5.0906 or later.

Name of the Vulnerable Software and Affected Versions: QNAP SMB Service versions prior to 4.15.002 QNAP SMB Service h versions prior to h4.15.002 Description: A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. The vulnerability is related to the lack of protection of the SQL query structure. It has been exploited in recent hacking contests, showcasing high-risk attack vectors, and may allow unauthorized access to QNAP NAS devices and sensitive data. Recommendations: For QNAP SMB Service versions prior to 4.15.002, update to version 4.15.002 or later. For QNAP SMB Service h versions prior to h4.15.002, update to version h4.15.002 or later. As a temporary workaround, consider restricting access to the SMB Service until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.22 Oracle VM VirtualBox versions prior to 7.1.2 **Description** A difficult to exploit vulnerability in Oracle VM VirtualBox allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. The vulnerability is related to errors in authorization due to a buffer overflow in memory. Successful attacks can result in takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. **Recommendations** For Oracle VM VirtualBox versions prior to 7.0.22, update to version 7.0.22 or later. For Oracle VM VirtualBox versions prior to 7.1.2, update to version 7.1.2 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Media Streaming add-on versions prior to 500.1.1.5 **Description** An OS command injection issue has been reported, affecting the Media Streaming add-on. This could allow authenticated administrators to execute commands via a network. The issue is remotely exploitable. **Recommendations** For Media Streaming add-on versions prior to 500.1.1.5, update to version 500.1.1.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Media Streaming add-on versions prior to 500.1.1.5 **Description** An exposure of sensitive information issue has been reported, potentially allowing users to compromise the security of the system via a network. **Recommendations** For versions prior to 500.1.1.5, update to version 500.1.1.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Photo Station versions prior to 6.4.2 **Description** A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. **Recommendations** For versions prior to 6.4.2, update to Photo Station 6.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TP-Link Omada ER605 (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. The specific flaw exists within the handling of DHCP options, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Authentication is not required to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.