Simone Bossi and Raffaele Bova at Nozomi Networks

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.

A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.

A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.

A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.

A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.