[FD] 0day Rubbish batch 17 - 12 advisories (3 unauthenticated) in closed-source products

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

Hello,

We are publishing a batch of twelve advisories in closed-source products. Each
advisory ships a full root-cause analysis and a working proof of concept; the
details are in the linked pages and in the repository. Summary of impact:

 1. HAProxy ALOHA VA 18.0.12-1820 - CVSS 9.8
    unauthenticated root command execution through the WUI File Manager and the 
init framework's execution of config.rc
    https://0day-rubbish.com/blog/wfm-configrc-sysset-command-injection-root-rce

 2. Peplink PotSa EU fw-potsa_eu-1.2.0-build1873 - CVSS 9.8
    unauthenticated root command execution in web_httpd through the WiFi 
passphrase field
    https://0day-rubbish.com/blog/wifi-passphrase-command-injection-root-rce

 3. NetCat CMS 7.2.0 (build 26228) - CVSS 9.8
    unauthenticated code execution through the installer's restore-from-URL 
archive handling, before installation
    https://0day-rubbish.com/blog/installer-remote-archive-rce

 4. D-Link DAP-2310B as shipped - CVSS 7.2
    authenticated root command execution through the atp ExeShell built-in
    https://0day-rubbish.com/blog/exeshell-command-injection-root-rce

 5. Grandstream GDS371x 1.0.13.10 - CVSS 7.2
    authenticated command execution through /goform/apicmd's config-file 
removal branch
    https://0day-rubbish.com/blog/apicmd-config-rm-command-injection-root-rce

 6. Eltex SMG-1016M 3.20.5.4900 - CVSS 7.2
    authenticated root command execution through clish ftpd user add and the 
vendor helper scripts
    https://0day-rubbish.com/blog/clsh-ftp-user-command-injection-root-rce

 7. Advantech EKI-1522-AE D1.99_r3510 - CVSS 7.2
    authenticated root command execution through the mail-alarm fields
    https://0day-rubbish.com/blog/mail-server-command-injection-root-rce

 8. Cambium E410 / E510 / E600 / E700 4.2.3.3-r9 - CVSS 7.2
    authenticated path traversal in upload.sh leading to root execution
    https://0day-rubbish.com/blog/uploadsh-path-traversal-root-rce

 9. SearchBlox Enterprise Search 12.1.2 - CVSS 7.2
    authenticated JDBC injection through the database URL field reaching OS 
command execution as the service account
    https://0day-rubbish.com/blog/jdbc-url-injection-h2-init-rce

10. StoneFly SCVM 8.0.4.29 - CVSS 7.2
    authenticated root command execution through the iSNS ipaddress field
    https://0day-rubbish.com/blog/ff-isns-ipaddress-command-injection-root-rce

11. VoIPTools Relay for 3CX 20.9.34 - CVSS 7.2
    authenticated root command execution through SetLinuxFolderPermissions
    
https://0day-rubbish.com/blog/setlinuxfolderpermissions-command-injection-root-rce

12. Maian Cube 1.x - CVSS 7.2
    authenticated command execution through the license-generation passphrase 
field
    https://0day-rubbish.com/blog/license-gen-command-injection-rce

Repository: https://github.com/Exploit-Garbage/0day-Rubbish
Archive: https://0day-rubbish.com/blog

Three of the twelve are reachable with no session; the other nine require an
administrator session and publish 7.2 at PR:H for that reason. Nothing is
withheld and there is no condition attached to this publication.

Regards,
0day Rubbish Research Team
disclosure@xxxxxxxxxxxxxxxx
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/