Evertz SDN Vulnerability

Discovered by ONEKEY Research Labs, the issue affects the main web admin interface used across several Evertz devices, threatening global media systems.The problem is an unauthenticated command injection in the PHP-based webEASY (ewb) interface. Devices like the SDVN 3080ipx-10G, MViP-II, cVIP, 7890IXG, CC Access Server, and 5782XPS-APP-4E are all affected.

Attackers can send special HTTP requests to run commands as root without needing any credentials.

The vulnerability comes from two PHP files—feature-transfer-import.php and feature-transfer-export.php—which use user input (action, filename, slot) to build shell commands without checking or sanitizing the input.

This lets attackers run commands by sending a simple request like:

curl ‘http:///v.1.5/php/features/feature-transfer-import.php?action=id;&filename=&varid=&slot=’

or

curl ‘http:///v.1.5/php/features/feature-transfer-export.php?action=id;&filename=&varid=&slot=’

To make things worse, the login.php authentication is broken. Attackers can create a base64-encoded JSON string that mimics an admin account to bypass the login:

bashcurl 'http://<device-ip>/login.php?authorized=<base64-encoded-admin-json>'

Using both flaws, an attacker can take full control of the device without logging in, run commands as root, and fully compromise the system.

Affected Products

Business Impact

This critical vulnerability (CVSS 9.3) allows attackers to run commands as root without logging in. If exploited, it can lead to:

• Stream disruptions – Live feeds can be stopped or changed.
• Content tampering – Attackers might alter media or captions.
• Full system takeover – Gaining root access to key broadcast systems.

Disclosure & Mitigation

Despite many contact attempts—including emails, social media, and CERT.CC—Evertz did not respond. As a result, the vulnerability was publicly disclosed two days after the 90-day deadline.

Key Points:

• This is ONEKEY’s first full public disclosure after 50 coordinated advisories.
• The flaw affects most Evertz products using the shared web admin backend.

Recommended Actions:

• Disconnect vulnerable interfaces from public or untrusted networks.
• Restrict access at the network level.
• Monitor traffic and logs for unusual web requests or shell activity.
• Wait for vendor patches and apply them as soon as available.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Evertz SDN Vulnerability Allows Arbitrary Command Execution appeared first on First Hackers News.

ASUS Vulnerability

The vulnerabilities are tied to the router firmware’s AiCloud feature. ASUS explains that these “injection and execution flaws” let authenticated attackers execute remote commands.

With a CVSS score of 7.2, both are rated as highly severe.

CVE Details:

• CVE-2024-12912: This vulnerability arises from inadequate validation within the AiCloud service, enabling attackers to inject and execute arbitrary commands on the affected routers.
• CVE-2024-13062: Similar to the first flaw, this issue stems from improperly sanitized input, creating another pathway for attackers to execute remote commands.

Users with vulnerable ASUS router models are at significant risk if these flaws remain unpatched, as they could lead to unauthorized control and potential data breaches.

ASUS strongly advises updating router firmware to the latest versions—3.0.0.4_386, 3.0.0.4_388, or 3.0.0.6_102—which include security fixes to mitigate these threats. Keeping firmware up to date is essential for ensuring device and network security.

For users unable to update immediately, ASUS recommends these steps:

• Set Strong Passwords: Use unique, complex passwords with at least 10 characters, including numbers, symbols, and mixed-case letters, for your network and router admin page.
• Enable AiCloud Protection: Ensure the AiCloud service is password-protected to block unauthorized access.
• Disable Unused Services: Turn off features like remote access, port forwarding, DDNS, VPN server, DMZ, and FTP when not needed.

ASUS stresses the importance of regularly updating router firmware and maintaining secure settings. Users should frequently check their device configurations and report security issues via ASUS’s vulnerability disclosure page.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post ASUS Vulnerabilities Allow Arbitrary Command Execution appeared first on First Hackers News.

Foxit PDF Reader vulnerability

A critical vulnerability in Foxit PDF Reader, identified as a use-after-free flaw, allows attackers to execute arbitrary code on a targeted system.

Exploitation occurs when a user opens a specially crafted PDF file or visits a malicious website while the Foxit PDF Reader browser extension is enabled. This vulnerability could be used to gain unauthorized access, potentially leading to system compromise or further attacks. Users are advised to update to the latest version to mitigate this risk.

Attackers can exploit the vulnerability to corrupt memory and take control of affected devices by manipulating the PDF’s JavaScript content.

Two critical vulnerabilities, TALOS-2024-2068 (CVE-2024-36474) and TALOS-2024-2069 (CVE-2024-42415), were found in the G Structured File Library (libgsf) of the GNOME project, potentially leading to remote code execution. These flaws result from integer overflows during array index and sector allocation table processing.

Attackers can exploit these vulnerabilities by tricking users into opening malicious files, potentially gaining unauthorized system access.

Three critical flaws were also found in Veertu’s Anka Build software, including two directory traversal vulnerabilities (TALOS-2024-2059, TALOS-2024-2061) that allow unauthorized file access via crafted HTTP requests.

A low-privileged user could exploit the TALOS-2024-2060 vulnerability in Anka Build to gain root access. Cisco Talos urges immediate action to address these critical security risks.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Foxit PDF Reader vulnerability allows attackers to execute arbitrary code appeared first on First Hackers News.

All about the chrome vulnerabilities

Three of the four security fixes in this update were reported by external researchers, highlighting collaboration’s role in browser security. The most severe vulnerabilities include:

• Integer Overflow in Layout (CVE-2024-7025): Could allow arbitrary code execution or denial of service.
• Insufficient Data Validation in Mojo (CVE-2024-9369): May lead to sensitive data leaks or privilege escalation.
• Inappropriate Implementation in V8 (CVE-2024-9370): Allows code execution or web content manipulation.

Google’s Chrome Vulnerability Rewards Program (VRP), active for 14 years, plays a key role in finding and fixing security flaws. The program offers up to $250,000 for reporting critical vulnerabilities.

Recently, Google increased rewards to encourage deeper research. For example, discovering a Remote Code Execution (RCE) flaw could earn up to $250,000, while finding a controlled write bug could bring in up to $90,000.

Chrome users should update their browsers right away to stay protected from these security risks. Although updates usually happen automatically, users can check for updates manually by going to the “About Google Chrome” section in settings.

The post Chrome vulnerabilities enable attackers to run arbitrary code appeared first on First Hackers News.

CVE-2024-45694-Stack-based Buffer Overflow

CVE-2024-45694 is a critical stack-based buffer overflow in D-Link DIR-X5460 A1 and DIR-X4860 A1 routers, with a CVSS score of 9.8.

Remote attackers can exploit this vulnerability to run arbitrary code, potentially taking control of the router and accessing sensitive data.

Update DIR-X5460 A1 to firmware version 1.11B04 or later and DIR-X4860 A1 to version 1.04B05 or later.

CVE-2024-45698: OS Command Injection

CVE-2024-45698 affects the DIR-X4860 A1 model, allowing OS command injection through improper input validation in the telnet service, with a CVSS score of 8.8.

Attackers can use hard-coded credentials to inject and execute arbitrary commands on the device, risking network and data security.

Update DIR-X4860 A1 firmware to version 1.04B05 or later.

CVE-2024-45697: Hidden Functionality

CVE-2024-45697 affects the DIR-X4860 A1 model, where hidden telnet functionality activates when the WAN port is connected, with a critical CVSS score of 9.8.

Unauthorized remote attackers can exploit this hidden telnet service using hard-coded credentials to execute OS commands, which poses significant security risks.

Update DIR-X4860 A1 firmware to version 1.04B05 or later to disable this hidden functionality.

CVE-2024-45695: Another Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the DIR-X4860 A1 model, with a critical CVSS score of 9.8.

Unauthenticated remote attackers can execute arbitrary code, risking unauthorized access and control over network resources.

Update DIR-X4860 A1 firmware to version 1.04B05 or later to mitigate this threat.

CVE-2024-45696: Hidden Functionality in Multiple Models

This vulnerability affects the DIR-X4860 A1 and COVR-X1870 models, with a high CVSS score of 8.8.

Attackers can enable telnet services by sending specific packets and then log in with hard-coded credentials. While access is limited to the local network, it still poses significant risks.

Update DIR-X4860 A1 firmware to version 1.04B05 or later and COVR-X1870 firmware to v1.03B01 or later.

Maintaining updated firmware is crucial to prevent unauthorized access and control.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Critical Vulnerabilities Impact Millions of D-Link Routers — Patch Now! appeared first on First Hackers News.

CVE-2022-41622 and CVE-2022-41800 Vulnerabilities

An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl SOAP into performing critical actions. An attacker can exploit this vulnerability only through the control plane, not through the data plane. If exploited, the vulnerability can compromise the complete system.

According to researcher Ron Bowes, SELinux bypasses are necessary for a few exploit paths. 

The second vulnerability, identified as CVE-2022-41800, could be exploited in appliance mode, allowing an authenticated remote attacker to execute arbitrary code in iControl REST. 

Which F5 Products are Vulnerable?

Mitigation

Hotfixes are available. Users are recommended to keep checking AskF5, as fixes for these vulnerabilities will be released soon. 

The post F5 Released Hotfixes for BIG-IP and iControl REST Vulnerabilities appeared first on First Hackers News.

The CVE-2022-35737 flaw is an integer overflow issue that impacts SQLite versions 1.0.12 through 3.39.1. The vulnerability was addressed with the release of version 3.39.2 on July 21, 2022.

SQLite

SQLite’s description of the vulnerability, it can only come up when “very long string inputs (greater than 2 billion bytes in length) are provided as arguments to a few specific C-language interfaces

To exploit the vulnerability, an attacker must pass large strings as inputs to the SQLite implementations of the printf functions (sqlite3_str_vappendf) and include the format specifiers “%q,” “%Q,” or “%w” in the format string.

A signed integer overflow is triggered when the sqlite3_str_vappendf function receives a large string and when the format substitution type is %q, %Q, or %w.

However, SQLite database engine was developed in C and is widely used today.

Following operating systems and web browsers include it by default:-

OS:

• Android
• iOS
• Windows
• macOS

Web Browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari

Security recommendation

SQLite release 3.39.2 was made available in late July to fix the issue.

There are no reported exploits in the wild related to this vulnerability. However, Trail of Bits published a proof-of-concept exploit codes (see GitHub) and public disclosure of the vulnerability. 

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post 22 Years Old Vulnerability in SQLite Allows Arbitrary Code Execution appeared first on First Hackers News.