Vulnerabilidades

A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated cameras and compromise…

Memory corruption during PlayReady APP usecase while processing TA commands.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Cryptographic issue while performing RSA PKCS padding decoding.

Transient DOS while processing received beacon frame.

Transient DOS may occur while processing malformed length field in SSID IEs.

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Memory corruption while processing API calls to NPU with invalid input.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

Memory corruption when there is failed unmap operation in GPU.

Memory corruption while processing finish_sign command to pass a rsp buffer.

Memory corruption in SPS Application while requesting for public key in sorter TA.

Memory corruption in Audio while processing RT proxy port register driver.

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Memory corruption in Audio during playback with speaker protection.

Memory corruption in HLOS while running playready use-case.

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Memory Corruption in SPS Application while exporting public key in sorter TA.

An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.

An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req - this is an information leak because the serial number is intended to prove an actor's physical access to the device.

Information disclosure in IOE Firmware while handling WMI command.

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.