CVE Disclosures
Out-of-bounds read in MikroTik RouterOS xt_tls kernel module
The xt_tls module reads the attacker-supplied SNI hostname length from a TLS ClientHello without validating it against the packet bounds, allowing a remote attacker to leak kernel memory adjacent to the packet buffer whenever a tls-host firewall rule is configured.
Out-of-bounds write via unvalidated nl_group in MikroTik RouterOS ULOG target
The ULOG iptables target registers no .checkentry callback, so an nl_group value of 0 produces an out-of-bounds index (ffs(0) - 1) into the ulog_buffers array, allowing a local attacker to crash the kernel or potentially escalate privileges.
Integer overflow leading to kernel heap overflow in MikroTik RouterOS ipt_SAME
Summing the sizes of the configured address ranges in same_check() overflows a 32-bit counter, producing an undersized allocation that is subsequently written past its bounds and giving a local attacker a kernel heap overflow usable for denial of service or privilege escalation.
Divide-by-zero in MikroTik RouterOS per_connection_classifier match
With no .checkentry callback to validate the divisor, a per_connection_classifier rule installed with denominator=0 triggers a division by zero in pcc_match(), panicking the kernel as soon as a matching packet is processed.
Integer overflow leading to divide-by-zero in MikroTik RouterOS xt_misc limit match
The limit match's limit_check() guards against a zero time value but not against time * HZ overflowing to zero, so a crafted time value causes a divide-by-zero and kernel panic during rule installation, without any packet being sent.
Session fixation in Apache Shiro
In Apache Shiro, when a session already exists, it is not invalidated upon successful login, nor is a new session generated with a new ID.
Advisory on Apache Shiro's website
Insufficient SCRAM-SHA-256 authentication in Apache HttpComponents HttpClient
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification.
Advisory in Apache mailing list
Parameter injection in WhoDB database connection strings
WhoDB is vulnerable to parameter injection in database connection strings, allowing attackers to inject arbitrary parameters and read local files through MySQL's allowAllFiles parameter.
Path traversal vulnerability in WhoDB SQLite database access
Path traversal vulnerability in WhoDB allowing unauthenticated attackers to open and read any SQLite3 database on the host system by bypassing directory restrictions through ../ sequences.
Container mount abuse in MikroTik RouterOS for code execution
Symlink resolution flaws in RouterOS container mount points allow attackers to mount arbitrary directories and execute code on the host device by abusing symbolic links as mount portals.
Command injection via AT commands on Quectel RG500Q-EA 5G modem
Command injection vulnerability in the AT+QFOTADL command handler on Quectel RG500Q-EA modems, allowing root code execution through unsanitized user input in OTA download procedures.
File inclusion vulnerability in Nim's reStructuredText processor
Despite documentation claiming include directives are disabled in online environments, Nim's rstToHtml procedure allows local file inclusion through both standard include directives and undocumented code-block file parameter.
Command injection via AT commands on Quectel EG25-G modem
Command injection vulnerability in the AT+QFUMOCFG command parser on Quectel EG25-G modems (including PinePhone), allowing root code execution through unsanitized user input.
Unsafe firewall includes allowing remote code execution on IOPSYS
Authenticated users can abuse firewall include configuration options to execute arbitrary scripts as root by injecting malicious dhcp-script and conf-script directives into firewall configuration.
Privilege escalation via Samba configuration manipulation on IOPSYS
Multiple safe features combine to allow filesystem read-write access and root shell on IOPSYS devices by manipulating Samba configuration files through /tmp write access and symlink resolution.
Privilege escalation via p910nd printer daemon configuration abuse
Authenticated users can modify p910nd printer daemon configuration to point to arbitrary files for read/write access as root, leading to information disclosure and remote code execution.
Remote code execution via DHCP daemon configuration in IOPSYS
Authenticated attackers can modify odhcpd configuration to execute arbitrary commands as root by manipulating the leasetrigger parameter combined with Samba share file uploads.
ACL misconfiguration leading to root access on Inteno routers
Misconfigured Access Control Lists allow authenticated users to read arbitrary files, write SSH keys, and gain root access through the file and router.dropbear ubus calls.
