Affected products vulnerabilities

The affected products are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.

A vulnerability in affected products allows an attacker with basic user privileges to gain access to users' projects. The attacker can modify and delete projects.