VARIoT IoT vulnerabilities database

In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock. Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zero refcnt. If that happens, the refcnt taken by tcp_twsk_unique() is overwritten and sock_put() will cause underflow, triggering a real use-after-free somewhere else. To avoid the use-after-free, we need to use refcount_inc_not_zero() in tcp_twsk_unique() and give up on reusing the port if it returns false. [0]: refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 CPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1 Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 RIP: 0010:refcount_warn_saturate+0xe5/0x110 Code: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff <0f> 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8 RSP: 0018:ffffc90006b43b60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888009bb3ef0 RCX: 0000000000000027 RDX: ffff88807be218c8 RSI: 0000000000000001 RDI: ffff88807be218c0 RBP: 0000000000069d70 R08: 0000000000000000 R09: ffffc90006b439f0 R10: ffffc90006b439e8 R11: 0000000000000003 R12: ffff8880029ede84 R13: 0000000000004e20 R14: ffffffff84356dc0 R15: ffff888009bb3ef0 FS: 00007f62c10926c0(0000) GS:ffff88807be00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020ccb000 CR3: 000000004628c005 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> ? refcount_warn_saturate+0xe5/0x110 ? __warn+0x81/0x130 ? refcount_warn_saturate+0xe5/0x110 ? report_bug+0x171/0x1a0 ? refcount_warn_saturate+0xe5/0x110 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? refcount_warn_saturate+0xe5/0x110 tcp_twsk_unique+0x186/0x190 __inet_check_established+0x176/0x2d0 __inet_hash_connect+0x74/0x7d0 ? __pfx___inet_check_established+0x10/0x10 tcp_v4_connect+0x278/0x530 __inet_stream_connect+0x10f/0x3d0 inet_stream_connect+0x3a/0x60 __sys_connect+0xa8/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0x83/0x170 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7f62c11a885d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007f62c1091e58 EFLAGS: 00000296 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020ccb004 RCX: 00007f62c11a885d RDX: 0000000000000010 RSI: 0000000020ccb000 RDI: 0000000000000003 RBP: 00007f62c1091e90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 00007f62c10926c0 R13: ffffffffffffff88 R14: 0000000000000000 R15: 00007ffe237885b0 </TASK>. ec94c2696f0b (( "tcp/dccp: timewait for hash dance 1 Avoid atomic operations " )onwards, inet_twsk_hashdance() teeth TIME-WAIT Socket ehash After releasing the bucket lock sk_refcnt Therefore, connect() Another thread tries to reuse the port during refcnt But 0 of TIME-WAIT For sockets tcp_twsk_unique() Within sock_hold() There is a small race condition that can call tcp_twsk_unique() Obtained at refcnt is overwritten, sock_put() causes underflow, and elsewhere the actual Use-after-free induces. [0]: refcount_t: 0 By adding to use-after-free occurs. The version is 6.8.6-200.fc39.x86_64 #1 The hardware name is VMware, Inc. VMware20,1/440BX Desktop Reference Platform in, BIOS teeth VMW201.00V.21805430.B64.2305221830 (( 2023 Year 5 Moon 22 (Sun). RIP teeth 0010:refcount_warn_saturate+0xe5/0x110 The following is omitted, but there is a detailed call trace etc.All information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks that exploit this vulnerability will not affect other software. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use. Indeed ip6_dst_idev() can return NULL, and must always be checked. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline] RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267 Code: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c RSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700 RDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760 RBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd R10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000 R13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00 FS: 00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317 fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108 ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline] ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649 ip6_route_output include/net/ip6_route.h:93 [inline] ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120 ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250 sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326 sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455 sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662 sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099 __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197 sctp_connect net/sctp/socket.c:4819 [inline] sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834 __sys_connect_file net/socket.c:2048 [inline] __sys_connect+0x2df/0x310 net/socket.c:2065 __do_sys_connect net/socket.c:2075 [inline] __se_sys_connect net/socket.c:2072 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2072 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f. Linux of Linux Kernel for, NULL There is a vulnerability in pointer dereference.Service operation interruption (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server. ========================================================================== Ubuntu Security Notice USN-6950-4 August 21, 2024 linux-hwe-5.15 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-hwe-5.15: Linux hardware enablement (HWE) kernel Details: Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - Block layer subsystem; - Bluetooth drivers; - Clock framework and drivers; - FireWire subsystem; - GPU drivers; - InfiniBand drivers; - Multiple devices driver; - EEPROM drivers; - Network drivers; - Pin controllers subsystem; - Remote Processor subsystem; - S/390 drivers; - SCSI drivers; - 9P distributed file system; - Network file system client; - SMB network file system; - Socket messages infrastructure; - Dynamic debug library; - Bluetooth subsystem; - Networking core; - IPv4 networking; - IPv6 networking; - Multipath TCP; - NSH protocol; - Phonet protocol; - TIPC protocol; - Wireless networking; - Key management; - ALSA framework; - HD-audio driver; (CVE-2024-36883, CVE-2024-36940, CVE-2024-36902, CVE-2024-36975, CVE-2024-36964, CVE-2024-36938, CVE-2024-36931, CVE-2024-35848, CVE-2024-26900, CVE-2024-36967, CVE-2024-36904, CVE-2024-27398, CVE-2024-36031, CVE-2023-52585, CVE-2024-36886, CVE-2024-36937, CVE-2024-36954, CVE-2024-36916, CVE-2024-36905, CVE-2024-36959, CVE-2024-26980, CVE-2024-26936, CVE-2024-36928, CVE-2024-36889, CVE-2024-36929, CVE-2024-36933, CVE-2024-27399, CVE-2024-36946, CVE-2024-36906, CVE-2024-36965, CVE-2024-36957, CVE-2024-36941, CVE-2024-36897, CVE-2024-36952, CVE-2024-36947, CVE-2024-36950, CVE-2024-36880, CVE-2024-36017, CVE-2023-52882, CVE-2024-36969, CVE-2024-38600, CVE-2024-36955, CVE-2024-36960, CVE-2024-27401, CVE-2024-36919, CVE-2024-36934, CVE-2024-35947, CVE-2024-36953, CVE-2024-36944, CVE-2024-36939) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS linux-image-5.15.0-118-generic 5.15.0-118.128~20.04.1 linux-image-5.15.0-118-generic-64k 5.15.0-118.128~20.04.1 linux-image-5.15.0-118-generic-lpae 5.15.0-118.128~20.04.1 linux-image-generic-64k-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-generic-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-generic-lpae-hwe-20.04 5.15.0.118.128~20.04.1 linux-image-oem-20.04 5.15.0.118.128~20.04.1 linux-image-oem-20.04b 5.15.0.118.128~20.04.1 linux-image-oem-20.04c 5.15.0.118.128~20.04.1 linux-image-oem-20.04d 5.15.0.118.128~20.04.1 linux-image-virtual-hwe-20.04 5.15.0.118.128~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6950-4 https://ubuntu.com/security/notices/USN-6950-3 https://ubuntu.com/security/notices/USN-6950-2 https://ubuntu.com/security/notices/USN-6950-1 CVE-2023-52585, CVE-2023-52882, CVE-2024-26900, CVE-2024-26936, CVE-2024-26980, CVE-2024-27398, CVE-2024-27399, CVE-2024-27401, CVE-2024-35848, CVE-2024-35947, CVE-2024-36017, CVE-2024-36031, CVE-2024-36880, CVE-2024-36883, CVE-2024-36886, CVE-2024-36889, CVE-2024-36902, CVE-2024-36904, CVE-2024-36905, CVE-2024-36906, CVE-2024-36916, CVE-2024-36919, CVE-2024-36928, CVE-2024-36929, CVE-2024-36931, CVE-2024-36933, CVE-2024-36934, CVE-2024-36937, CVE-2024-36938, CVE-2024-36939, CVE-2024-36940, CVE-2024-36941, CVE-2024-36944, CVE-2024-36946, CVE-2024-36947, CVE-2024-36950, CVE-2024-36952, CVE-2024-36953, CVE-2024-36954, CVE-2024-36955, CVE-2024-36957, CVE-2024-36959, CVE-2024-36960, CVE-2024-36964, CVE-2024-36965, CVE-2024-36967, CVE-2024-36969, CVE-2024-36975, CVE-2024-38600 Package Information: https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-118.128~20.04.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disconnect. For a DWC3 based implementation, the callstack looks like the following: DWC3 Gadget FFS Application dwc3_gadget_soft_disconnect() ... --> dwc3_stop_active_transfers() --> dwc3_gadget_giveback(-ESHUTDOWN) --> ffs_epfile_async_io_complete() ffs_aio_cancel() --> usb_ep_free_request() --> usb_ep_dequeue() There is currently no locking implemented between the AIO completion handler and AIO cancel, so the issue occurs if the completion routine is running in parallel to an AIO cancel call coming from the FFS application. As the completion call frees the USB request (io_data->req) the FFS application is also referencing it for the usb_ep_dequeue() call. This can lead to accessing a stale/hanging pointer. commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") relocated the usb_ep_free_request() into ffs_epfile_async_io_complete(). However, in order to properly implement locking to mitigate this issue, the spinlock can't be added to ffs_epfile_async_io_complete(), as usb_ep_dequeue() (if successfully dequeuing a USB request) will call the function driver's completion handler in the same context. Hence, leading into a deadlock. Fix this issue by moving the usb_ep_free_request() back to ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req to NULL after freeing it within the ffs->eps_lock. This resolves the race condition above, as the ffs_aio_cancel() routine will not continue attempting to dequeue a request that has already been freed, or the ffs_user_copy_work() not freeing the USB request until the AIO cancel is done referencing it. This fix depends on commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently"). Linux of Linux Kernel There is a race condition vulnerability in.Information is obtained and service operation is interrupted (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on SINEC OS with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Multiple vulnerabilities exist in third-party components prior to SIEMENS SINEC OS V3.2. These vulnerabilities could be exploited to corrupt values, leading to undefined behavior or security issues. ========================================================================== Ubuntu Security Notice USN-7007-1 September 13, 2024 linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-raspi vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-ibm: Linux kernel for IBM cloud systems - linux-intel-iotg: Linux kernel for Intel IoT platforms - linux-kvm: Linux kernel for cloud environments - linux-nvidia: Linux kernel for NVIDIA systems - linux-oracle: Linux kernel for Oracle Cloud systems - linux-raspi: Linux kernel for Raspberry Pi systems - linux-aws-5.15: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems - linux-hwe-5.15: Linux hardware enablement (HWE) kernel - linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms Details: Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848) Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741) It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Accessibility subsystem; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Bluetooth drivers; - Character device driver; - CPU frequency scaling framework; - Hardware crypto device drivers; - Buffer Sharing and Synchronization framework; - DMA engine subsystem; - FPGA Framework; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsystem; - HW tracing; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - Input Device (Mouse) drivers; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - VMware VMCI Driver; - Network drivers; - Near Field Communication (NFC) drivers; - NVME drivers; - Pin controllers subsystem; - PTP clock framework; - S/390 drivers; - SCSI drivers; - SoundWire subsystem; - Greybus lights staging drivers; - Media staging drivers; - Thermal drivers; - TTY drivers; - USB subsystem; - DesignWare USB3 driver; - Framebuffer layer; - ACRN Hypervisor Service Module driver; - eCrypt file system; - File systems infrastructure; - Ext4 file system; - F2FS file system; - JFFS2 file system; - JFS file system; - NILFS2 file system; - NTFS3 file system; - SMB network file system; - IOMMU subsystem; - Memory management; - Netfilter; - BPF subsystem; - Kernel debugger infrastructure; - DMA mapping infrastructure; - IRQ subsystem; - Tracing infrastructure; - 9P file system network protocol; - B.A.T.M.A.N. meshing protocol; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - IPv6 networking; - IUCV driver; - MAC80211 subsystem; - Multipath TCP; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - Network traffic control; - TIPC protocol; - TLS protocol; - Unix domain sockets; - Wireless networking; - XFRM subsystem; - ALSA framework; - SoC Audio for Freescale CPUs drivers; - Kirkwood ASoC drivers; (CVE-2024-40961, CVE-2024-38597, CVE-2024-39468, CVE-2024-36978, CVE-2024-42161, CVE-2024-38573, CVE-2024-40905, CVE-2024-42094, CVE-2024-36894, CVE-2024-40914, CVE-2024-40956, CVE-2024-42106, CVE-2024-38610, CVE-2024-39506, CVE-2024-42098, CVE-2024-42232, CVE-2024-38590, CVE-2024-39488, CVE-2024-42127, CVE-2024-41006, CVE-2024-42131, CVE-2024-41005, CVE-2024-40963, CVE-2024-38559, CVE-2024-42130, CVE-2024-37078, CVE-2024-42082, CVE-2024-40984, CVE-2024-38560, CVE-2024-42090, CVE-2024-33621, CVE-2024-40974, CVE-2024-42115, CVE-2024-40971, CVE-2024-40943, CVE-2024-38627, CVE-2024-38548, CVE-2024-40934, CVE-2024-38579, CVE-2024-38558, CVE-2024-39495, CVE-2023-52884, CVE-2024-42225, CVE-2024-38659, CVE-2024-40927, CVE-2024-40967, CVE-2024-38624, CVE-2024-38583, CVE-2024-41047, CVE-2024-38623, CVE-2024-39509, CVE-2024-36971, CVE-2024-42120, CVE-2024-38589, CVE-2024-36270, CVE-2024-42105, CVE-2024-36032, CVE-2024-42101, CVE-2024-40908, CVE-2024-42089, CVE-2024-39482, CVE-2024-38662, CVE-2024-41007, CVE-2024-38635, CVE-2023-52887, CVE-2024-40912, CVE-2024-41027, CVE-2024-38598, CVE-2024-38381, CVE-2024-39503, CVE-2024-39301, CVE-2024-40988, CVE-2024-41000, CVE-2024-39507, CVE-2024-35247, CVE-2024-39277, CVE-2024-42229, CVE-2024-42085, CVE-2024-35927, CVE-2024-42224, CVE-2024-38567, CVE-2024-42097, CVE-2024-41049, CVE-2024-39466, CVE-2024-40957, CVE-2024-40978, CVE-2024-42093, CVE-2024-40937, CVE-2024-41034, CVE-2024-41048, CVE-2024-39471, CVE-2024-39502, CVE-2024-38555, CVE-2024-40970, CVE-2024-36972, CVE-2024-40995, CVE-2024-42154, CVE-2024-40916, CVE-2024-39505, CVE-2024-39475, CVE-2024-38599, CVE-2024-38596, CVE-2024-39493, CVE-2024-42124, CVE-2024-38549, CVE-2024-42084, CVE-2024-40942, CVE-2024-42077, CVE-2024-42152, CVE-2024-40904, CVE-2024-31076, CVE-2024-40960, CVE-2024-41035, CVE-2024-40945, CVE-2024-38605, CVE-2024-42140, CVE-2024-41041, CVE-2024-36014, CVE-2024-38612, CVE-2024-41092, CVE-2024-38546, CVE-2024-40902, CVE-2024-42068, CVE-2024-42121, CVE-2024-42236, CVE-2024-34777, CVE-2024-39467, CVE-2024-42087, CVE-2024-39501, CVE-2024-40980, CVE-2024-38550, CVE-2024-42223, CVE-2024-38607, CVE-2024-42247, CVE-2024-41046, CVE-2024-42080, CVE-2024-40901, CVE-2024-38571, CVE-2024-39480, CVE-2024-42070, CVE-2024-41093, CVE-2024-42148, CVE-2024-38601, CVE-2024-39500, CVE-2024-41097, CVE-2024-38565, CVE-2024-38661, CVE-2024-38615, CVE-2024-41040, CVE-2024-34027, CVE-2024-37356, CVE-2024-42157, CVE-2024-40941, CVE-2024-38634, CVE-2024-41004, CVE-2024-38780, CVE-2024-38552, CVE-2024-39276, CVE-2024-38618, CVE-2024-38588, CVE-2024-42086, CVE-2024-41087, CVE-2024-38582, CVE-2024-40932, CVE-2024-39489, CVE-2024-40968, CVE-2024-42119, CVE-2024-42137, CVE-2024-40929, CVE-2024-38591, CVE-2024-36489, CVE-2022-48772, CVE-2024-42153, CVE-2024-40959, CVE-2024-40987, CVE-2024-36015, CVE-2024-41044, CVE-2024-41002, CVE-2024-42109, CVE-2024-38587, CVE-2024-36286, CVE-2024-41055, CVE-2024-39469, CVE-2024-39487, CVE-2024-38580, CVE-2024-38619, CVE-2024-38613, CVE-2024-42145, CVE-2024-41095, CVE-2024-40958, CVE-2024-40911, CVE-2024-42102, CVE-2024-33847, CVE-2024-36974, CVE-2024-40994, CVE-2024-38633, CVE-2024-40981, CVE-2024-40983, CVE-2024-42096, CVE-2024-42104, CVE-2024-42092, CVE-2024-40954, CVE-2024-38637, CVE-2024-42240, CVE-2024-38621, CVE-2024-38578, CVE-2024-38547, CVE-2024-39490, CVE-2024-42076, CVE-2024-42244, CVE-2024-39499, CVE-2024-38586, CVE-2024-41089, CVE-2024-40976, CVE-2024-42095, CVE-2024-40931, CVE-2024-40990) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS linux-image-5.15.0-1052-gkeop 5.15.0-1052.59 linux-image-5.15.0-1062-ibm 5.15.0-1062.65 linux-image-5.15.0-1062-raspi 5.15.0-1062.65 linux-image-5.15.0-1064-intel-iotg 5.15.0-1064.70 linux-image-5.15.0-1064-nvidia 5.15.0-1064.65 linux-image-5.15.0-1064-nvidia-lowlatency 5.15.0-1064.65 linux-image-5.15.0-1066-gke 5.15.0-1066.72 linux-image-5.15.0-1066-kvm 5.15.0-1066.71 linux-image-5.15.0-1067-oracle 5.15.0-1067.73 linux-image-5.15.0-1068-gcp 5.15.0-1068.76 linux-image-5.15.0-1069-aws 5.15.0-1069.75 linux-image-5.15.0-121-generic 5.15.0-121.131 linux-image-5.15.0-121-generic-64k 5.15.0-121.131 linux-image-5.15.0-121-generic-lpae 5.15.0-121.131 linux-image-aws-lts-22.04 5.15.0.1069.69 linux-image-gcp-lts-22.04 5.15.0.1068.64 linux-image-generic 5.15.0.121.121 linux-image-generic-64k 5.15.0.121.121 linux-image-generic-lpae 5.15.0.121.121 linux-image-gke 5.15.0.1066.65 linux-image-gke-5.15 5.15.0.1066.65 linux-image-gkeop 5.15.0.1052.51 linux-image-gkeop-5.15 5.15.0.1052.51 linux-image-ibm 5.15.0.1062.58 linux-image-intel-iotg 5.15.0.1064.64 linux-image-kvm 5.15.0.1066.62 linux-image-nvidia 5.15.0.1064.64 linux-image-nvidia-lowlatency 5.15.0.1064.64 linux-image-oracle-lts-22.04 5.15.0.1067.63 linux-image-raspi 5.15.0.1062.60 linux-image-raspi-nolpae 5.15.0.1062.60 linux-image-virtual 5.15.0.121.121 Ubuntu 20.04 LTS linux-image-5.15.0-1052-gkeop 5.15.0-1052.59~20.04.1 linux-image-5.15.0-1064-intel-iotg 5.15.0-1064.70~20.04.1+1 linux-image-5.15.0-1068-gcp 5.15.0-1068.76~20.04.1 linux-image-5.15.0-1069-aws 5.15.0-1069.75~20.04.1 linux-image-5.15.0-121-generic 5.15.0-121.131~20.04.1 linux-image-5.15.0-121-generic-64k 5.15.0-121.131~20.04.1 linux-image-5.15.0-121-generic-lpae 5.15.0-121.131~20.04.1 linux-image-aws 5.15.0.1069.75~20.04.1 linux-image-gcp 5.15.0.1068.76~20.04.1 linux-image-generic-64k-hwe-20.04 5.15.0.121.131~20.04.1 linux-image-generic-hwe-20.04 5.15.0.121.131~20.04.1 linux-image-generic-lpae-hwe-20.04 5.15.0.121.131~20.04.1 linux-image-gkeop-5.15 5.15.0.1052.59~20.04.1 linux-image-intel 5.15.0.1064.70~20.04.1 linux-image-intel-iotg 5.15.0.1064.70~20.04.1 linux-image-oem-20.04 5.15.0.121.131~20.04.1 linux-image-oem-20.04b 5.15.0.121.131~20.04.1 linux-image-oem-20.04c 5.15.0.121.131~20.04.1 linux-image-oem-20.04d 5.15.0.121.131~20.04.1 linux-image-virtual-hwe-20.04 5.15.0.121.131~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-7007-1 CVE-2022-48772, CVE-2023-52884, CVE-2023-52887, CVE-2024-23848, CVE-2024-25741, CVE-2024-31076, CVE-2024-33621, CVE-2024-33847, CVE-2024-34027, CVE-2024-34777, CVE-2024-35247, CVE-2024-35927, CVE-2024-36014, CVE-2024-36015, CVE-2024-36032, CVE-2024-36270, CVE-2024-36286, CVE-2024-36489, CVE-2024-36894, CVE-2024-36971, CVE-2024-36972, CVE-2024-36974, CVE-2024-36978, CVE-2024-37078, CVE-2024-37356, CVE-2024-38381, CVE-2024-38546, CVE-2024-38547, CVE-2024-38548, CVE-2024-38549, CVE-2024-38550, CVE-2024-38552, CVE-2024-38555, CVE-2024-38558, CVE-2024-38559, CVE-2024-38560, CVE-2024-38565, CVE-2024-38567, CVE-2024-38571, CVE-2024-38573, CVE-2024-38578, CVE-2024-38579, CVE-2024-38580, CVE-2024-38582, CVE-2024-38583, CVE-2024-38586, CVE-2024-38587, CVE-2024-38588, CVE-2024-38589, CVE-2024-38590, CVE-2024-38591, CVE-2024-38596, CVE-2024-38597, CVE-2024-38598, CVE-2024-38599, CVE-2024-38601, CVE-2024-38605, CVE-2024-38607, CVE-2024-38610, CVE-2024-38612, CVE-2024-38613, CVE-2024-38615, CVE-2024-38618, CVE-2024-38619, CVE-2024-38621, CVE-2024-38623, CVE-2024-38624, CVE-2024-38627, CVE-2024-38633, CVE-2024-38634, CVE-2024-38635, CVE-2024-38637, CVE-2024-38659, CVE-2024-38661, CVE-2024-38662, CVE-2024-38780, CVE-2024-39276, CVE-2024-39277, CVE-2024-39301, CVE-2024-39466, CVE-2024-39467, CVE-2024-39468, CVE-2024-39469, CVE-2024-39471, CVE-2024-39475, CVE-2024-39480, CVE-2024-39482, CVE-2024-39487, CVE-2024-39488, CVE-2024-39489, CVE-2024-39490, CVE-2024-39493, CVE-2024-39495, CVE-2024-39499, CVE-2024-39500, CVE-2024-39501, CVE-2024-39502, CVE-2024-39503, CVE-2024-39505, CVE-2024-39506, CVE-2024-39507, CVE-2024-39509, CVE-2024-40901, CVE-2024-40902, CVE-2024-40904, CVE-2024-40905, CVE-2024-40908, CVE-2024-40911, CVE-2024-40912, CVE-2024-40914, CVE-2024-40916, CVE-2024-40927, CVE-2024-40929, CVE-2024-40931, CVE-2024-40932, CVE-2024-40934, CVE-2024-40937, CVE-2024-40941, CVE-2024-40942, CVE-2024-40943, CVE-2024-40945, CVE-2024-40954, CVE-2024-40956, CVE-2024-40957, CVE-2024-40958, CVE-2024-40959, CVE-2024-40960, CVE-2024-40961, CVE-2024-40963, CVE-2024-40967, CVE-2024-40968, CVE-2024-40970, CVE-2024-40971, CVE-2024-40974, CVE-2024-40976, CVE-2024-40978, CVE-2024-40980, CVE-2024-40981, CVE-2024-40983, CVE-2024-40984, CVE-2024-40987, CVE-2024-40988, CVE-2024-40990, CVE-2024-40994, CVE-2024-40995, CVE-2024-41000, CVE-2024-41002, CVE-2024-41004, CVE-2024-41005, CVE-2024-41006, CVE-2024-41007, CVE-2024-41027, CVE-2024-41034, CVE-2024-41035, CVE-2024-41040, CVE-2024-41041, CVE-2024-41044, CVE-2024-41046, CVE-2024-41047, CVE-2024-41048, CVE-2024-41049, CVE-2024-41055, CVE-2024-41087, CVE-2024-41089, CVE-2024-41092, CVE-2024-41093, CVE-2024-41095, CVE-2024-41097, CVE-2024-42068, CVE-2024-42070, CVE-2024-42076, CVE-2024-42077, CVE-2024-42080, CVE-2024-42082, CVE-2024-42084, CVE-2024-42085, CVE-2024-42086, CVE-2024-42087, CVE-2024-42089, CVE-2024-42090, CVE-2024-42092, CVE-2024-42093, CVE-2024-42094, CVE-2024-42095, CVE-2024-42096, CVE-2024-42097, CVE-2024-42098, CVE-2024-42101, CVE-2024-42102, CVE-2024-42104, CVE-2024-42105, CVE-2024-42106, CVE-2024-42109, CVE-2024-42115, CVE-2024-42119, CVE-2024-42120, CVE-2024-42121, CVE-2024-42124, CVE-2024-42127, CVE-2024-42130, CVE-2024-42131, CVE-2024-42137, CVE-2024-42140, CVE-2024-42145, CVE-2024-42148, CVE-2024-42152, CVE-2024-42153, CVE-2024-42154, CVE-2024-42157, CVE-2024-42161, CVE-2024-42223, CVE-2024-42224, CVE-2024-42225, CVE-2024-42229, CVE-2024-42232, CVE-2024-42236, CVE-2024-42240, CVE-2024-42244, CVE-2024-42247 Package Information: https://launchpad.net/ubuntu/+source/linux/5.15.0-121.131 https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1069.75 https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1068.76 https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1066.72 https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1052.59 https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1062.65 https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1064.70 https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1066.71 https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1064.65 https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1067.73 https://launchpad.net/ubuntu/+source/linux-raspi/5.15.0-1062.65 https://launchpad.net/ubuntu/+source/linux-aws-5.15/5.15.0-1069.75~20.04.1 https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1068.76~20.04.1 https://launchpad.net/ubuntu/+source/linux-gkeop-5.15/5.15.0-1052.59~20.04.1 https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-121.131~20.04.1 https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1064.70~20.04.1 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5731-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 16, 2024 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : linux CVE ID : CVE-2023-52760 CVE-2024-25741 CVE-2024-27397 CVE-2024-36894 CVE-2024-36973 CVE-2024-36978 CVE-2024-37078 CVE-2024-38619 CVE-2024-39298 CVE-2024-39371 CVE-2024-39469 CVE-2024-39474 CVE-2024-39484 CVE-2024-39487 CVE-2024-39494 CVE-2024-39495 CVE-2024-39496 CVE-2024-39499 CVE-2024-39500 CVE-2024-39501 CVE-2024-39502 CVE-2024-39503 CVE-2024-39505 CVE-2024-39506 CVE-2024-39507 CVE-2024-39509 CVE-2024-39510 CVE-2024-40899 CVE-2024-40900 CVE-2024-40901 CVE-2024-40902 CVE-2024-40903 CVE-2024-40904 CVE-2024-40905 CVE-2024-40906 CVE-2024-40908 CVE-2024-40910 CVE-2024-40911 CVE-2024-40912 CVE-2024-40913 CVE-2024-40914 CVE-2024-40915 CVE-2024-40916 CVE-2024-40919 CVE-2024-40920 CVE-2024-40921 CVE-2024-40924 CVE-2024-40927 CVE-2024-40929 CVE-2024-40931 CVE-2024-40932 CVE-2024-40934 CVE-2024-40935 CVE-2024-40937 CVE-2024-40938 CVE-2024-40939 CVE-2024-40940 CVE-2024-40941 CVE-2024-40942 CVE-2024-40943 CVE-2024-40947 CVE-2024-40948 CVE-2024-40953 CVE-2024-40954 CVE-2024-40956 CVE-2024-40957 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40961 CVE-2024-40963 CVE-2024-40966 CVE-2024-40967 CVE-2024-40968 CVE-2024-40970 CVE-2024-40971 CVE-2024-40974 CVE-2024-40976 CVE-2024-40977 CVE-2024-40978 CVE-2024-40980 CVE-2024-40981 CVE-2024-40983 CVE-2024-40984 CVE-2024-40987 CVE-2024-40988 CVE-2024-40989 CVE-2024-40990 CVE-2024-40993 CVE-2024-40994 CVE-2024-40995 CVE-2024-40996 CVE-2024-41000 CVE-2024-41001 CVE-2024-41002 CVE-2024-41004 CVE-2024-41005 CVE-2024-41006 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the stable distribution (bookworm), these problems have been fixed in version 6.1.99-1. We recommend that you upgrade your linux packages. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmaWylhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SMThAAiAanrQH+A4sTcRMZgwj521PKppx6+06c3jbqktG8XwQeOmaRrA1tgeyV ABahFSib/84PJtdqpW8+EHSJvGvxm9TKND98pPV6SjId2Ly7D+ARnfm6vIZzW/Sv WOZx0IU/So8qbZ7OjvKTfT+869yJ+MfRnYhdfuFTSJaZYehMyeizUMM5fjBX3dSf BBKcxR9w/RI2OgxiN45Q9+FrCCMS26RBTzRcb3pskw8741gzDyEostjjG+k5B8XJ /gEu10O3dGKtRV/1Uhkd5R4ACkcXHovox9EmA2vizGNfhf981cTeBT2ZIPIzstIY +/vkd4uUPi/OgIEBlkvcQx0UUaYctqDOnpvRqrLU9hwBkhlk0ueHxaHiBl9tf6L2 CDYb1BROY2A0eDSqCFugYMjzZDIbihFUS1Ly1TKDqea5xDTfiZcWa1u7bFp/LR2C 075lTh79e3GMdFceWfJk9SiPrFZnpCiokTmvbg4c0U7ac8ruXbAcV4i79exMTgwe VtUBFRufnLesmMmolGnqWSDA4Mf+w04MXJj3tU9N4MfC0bG0Y46IlNrabDOhUlns VdHvDLQOIMcFOl8rfKjFs+wTuUkRZUSFNQotG1WDiTezcQqbMS2eodVCB6Cq/51W L6oukVbbmncmYgYY3BGLTfn7ZxHUK3nhu/WmxtmwI4KsViLd8+Q= =KPq+ -----END PGP SIGNATURE-----

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules. TOTOLINK of CP900L A stack-based buffer overflow vulnerability exists in the firmware.Service operation interruption (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. The vulnerability is caused by the desc parameter of the setIpPortFilterRules function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. TOTOLINK of CP900L Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. No detailed vulnerability details are currently provided

A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb686c` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations. P3-550E firmware, P3-550 firmware, P3-530 firmware etc. AutomationDirect The product contains a vulnerability related to out-of-bounds writes.Information is tampered with and service operation is interrupted (DoS) It may be in a state. AutomationDirect P3-550E is a programmable control system (PLC) of AutomationDirect, Inc., USA

A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can send an unauthenticated packet to trigger this vulnerability. P3-550E firmware, P3-550 firmware, P3-530 firmware etc. AutomationDirect There are unspecified vulnerabilities in the product.Information may be obtained. AutomationDirect P3-550E is a programmable control system (PLC) of AutomationDirect, Inc. of the United States

A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to an arbitrary write. An attacker can send an unauthenticated packet to trigger this vulnerability. P3-550E firmware, P3-550 firmware, P3-530 firmware etc. AutomationDirect There are unspecified vulnerabilities in the product.Information is tampered with and service operation is interrupted (DoS) It may be in a state. AutomationDirect P3-550E is a programmable control system (PLC) of AutomationDirect, Inc. of the United States

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules. TOTOLINK of CP900L Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. TOTOLINK CP900L has a stack buffer overflow vulnerability. The vulnerability is caused by the desc parameter of the SetPortForwardRules function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth. TOTOLINK of CP900L A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. There is a buffer overflow vulnerability in the TOTOLINK CP900L v4.1.5cu.798_B20221228 version. The vulnerability is caused by the password parameter of the loginAuth function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules. TOTOLINK of CP900L Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. TOTOLINK CP900L v4.1.5cu.798_B20221228 has a stack overflow vulnerability. The vulnerability is caused by the failure of the desc parameter in the function setMacFilterRules to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. TOTOLINK of CP900L Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics

HP DesignJet T730 is a printer. HP DesignJet T730 of HP Trading (Shanghai) Co., Ltd. has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information.

TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode. TOTOLINK of nr1800x A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK NR1800X is a 5G NR indoor Wi-Fi and SIP CPE from China's TOTOLINK Electronics. It is designed to provide fast and convenient NR fixed data service deployment for homes and offices. TOTOLINK NR1800X v9.1.0u.6681_B20230703 version has a buffer overflow vulnerability. The vulnerability is caused by the password parameter in the urldecode function failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. TOTOLINK of lr350 A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK LR350 is a wireless router produced by China's TOTOLINK Electronics. TOTOLINK LR350 has a buffer overflow vulnerability. The vulnerability is caused by the http_host parameter in the loginAuth function failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root. TOTOLINK of CP900L A vulnerability exists in the firmware regarding the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. TOTOLINK CP900L has a hard-coded password vulnerability, which is caused by the hard-coded password in /web_cste/cgi-bin/product.ini

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. TOTOLINK of CP900L A vulnerability exists in the firmware related to the use of hardcoded passwords.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CP900L is a wireless router from China's TOTOLINK Electronics. TOTOLINK CP900L has a hard-coded password vulnerability, which is caused by the inclusion of a hard-coded password in /etc/shadow.sample

Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand. Shenzhen Tenda Technology Co.,Ltd. of fh1206 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the cmdinput parameter of ip/goform/formexeCommand failing to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to execute arbitrary commands on the system

Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac. Shenzhen Tenda Technology Co.,Ltd. of fh1206 A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Attackers can exploit this vulnerability to execute arbitrary commands

D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21294. D-Link Systems, Inc. of G416 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link G416 is a wireless router from D-Link, a Chinese company. D-Link G416 has a code execution vulnerability, which is caused by the application failing to properly filter special elements in the constructed code segment