Repository navigation
Seven findings in six closed-source commercial products. Each one ships a full root-cause analysis and a working PoC.
| # | Product | Version | CVSS | Advisory & PoC |
|---|---|---|---|---|
| 1 | Parasoft Continuous Testing Platform | 10.7.5-SNAPSHOT | 9.8 | license gate bypass → unfiltered Java deserialisation → uid 1000 |
| 2 | Exasol Database (docker-db) | 7.1.30 | 8.8 | shipped SYS credential → PYTHON3 UDF reaching os.popen, output returned through SELECT |
| 3 | Royal Render | 9.1.26b | 8.1 | job manager that performs no identity check unless one is switched on → worker root |
| 4 | ProSoft RLX-IFH24E | v2.2.44 | 7.2 | firmware upgrade executed with no integrity check → root + account database overwrite |
| 5 | Edimax BR-6478AC | v2.20 | 7.2 | formWlanMP manufacturing-test handler: ~30 parameters → sprintf → system() → root |
| 6 | Edimax BR-6478AC | v2.20 | 7.2 | setWAN handler: same sprintf → system() shape in a different field → root |
| 7 | TRENDnet TV-IP302PI | 1.02.38 | 7.2 | NTP server address → shell-form system() inside a root daemon |
Three of the seven need no credential at all; four are authenticated chains. Every finding reaches operating-system command execution inside the product's own service, handler or worker.
Each advisory publishes the readings it rejected next to the one it stands behind, each with its own vector and arithmetic, and says plainly which legs were measured against a live product, which were reproduced inside a controlled environment, and which are structural inference only. Five of the seven report root inside that environment rather than on a shipping device, and say so.
All seven, and the 131 before them: https://0day-rubbish.com/blog