Alertas de Seguridad de la Información

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or…

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

Se ha identificado una falla crítica (CVSS 10.0) en Ahsay AhsayCBS versiones hasta 10.3.2 que permite inyección de comandos del sistema operativo a través de manipulación del parámetro 'random' en el endpoint /rps/api/json/UpdateReceivers.do del componente Replication Receiver. El ataque es ejecutable remotamente sin autenticación y el exploit está públicamente disponible, afectando directamente a soluciones de backup y recuperación de desastres ampliamente utilizadas en empresas LATAM.