Zero Science Lab - Macedonian information security research and development laboratory https://www.zeroscience.mk en-us Friday, 07 Aug 2026 10:01:33 +0200 144400 http://www.zeroscience.mk https://www.zeroscience.mk/images/rss.gif https://www.zeroscience.mk/#/advisories/ZSL-2026-6002 Friday, 07 Aug 2026 10:00:00 +0200 LightFTP through version 2.4 (current master, commit d28c5e0) contains multiple data races in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. In worker_thread_cleanup(), invoked by the anonymous-reachable ABOR command, the control thread reads and writes context->data_socket, context->data_ipv4, and context->worker_thread_abort with no lock, while the detached worker thread (list_thread and its siblings) concurrently uses the same data socket and writes context->worker_thread_valid. Version 2.4 removed the MTLock mutex that previously guarded this state and replaced it with an atomic busy compare-and-swap that only serializes worker startup, not cleanup against a running worker, so the control thread closes and clears the data connection while the worker is still operating on it. ThreadSanitizer confirms data races at at least 16 distinct source locations (5 in worker_thread_cleanup), reproducible by an anonymous user with LIST followed by ABOR. The per-run report count is higher and scales with concurrency. The impact is undefined behavior with potential denial of service; a crash on a standard release build was not demonstrated. https://www.zeroscience.mk/#/advisories/ZSL-2026-6001 Tuesday, 04 Aug 2026 14:56:00 +0200 LightFTP 2.3.1 contains a residual race condition (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c. The control thread reads and acts on shared per-connection state, including the worker thread id it then passes to pthread_join()/pthread_cancel(), without holding the context->MTLock mutex that the worker threads use when updating that same state; and because the workers are detached, their thread id can be reused once they exit. A remote (anonymous) client triggers the window by starting a data-transfer command such as LIST and immediately issuing ABOR, running the unsynchronized cleanup while the worker is still finishing. ThreadSanitizer confirms multiple data races on the shared context and a mutex being destroyed while still in use, and the cleanup joins or cancels a detached, potentially reused thread id, which is undefined behavior that can destabilize or crash the daemon and result in denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup); it never added the missing lock, so the underlying race remains. https://www.zeroscience.mk/#/advisories/ZSL-2026-6000 Thursday, 30 Jul 2026 01:39:00 +0200 The device protects its configuration file (Router.cfg) with a weak/insecure obfuscation (single-byte XOR cipher) using a static key (0xEC) instead of real encryption. Because the same key is applied to the entire file, it is trivially recovered and the configuration can be decoded back to cleartext with a few lines of code. This discloses all stored secrets in plaintext, including the web administration and telnet passwords, the WPA/WPA2 pre-shared key, PPPoE/3G/APN credentials, and SIM identifiers (IMSI/IMEI). https://www.zeroscience.mk/#/advisories/ZSL-2026-5999 Tuesday, 14 Jul 2026 00:17:00 +0200 SIP executes user-configured operating-system commands when an irrigation station changes state, if the optional cli_control plugin is installed and enabled. This can be exploited to run arbitrary commands on the affected host by storing a command through the plugin's HTTP endpoint and then activating the associated station. When the optional passphrase is not enabled (factory default) both steps require no authentication, and where the passphrase is enabled it defaults to 'opendoor' and the same result is reachable through cross-site request forgery. https://www.zeroscience.mk/#/advisories/ZSL-2026-5998 Tuesday, 14 Jul 2026 00:16:00 +0200 The application accepts an attacker-supplied callback URL and, when the optional Node-RED plugin is installed, later issues server-side HTTP requests to that URL without validating it. This can be exploited to make the device send requests to arbitrary internal or external systems on the attacker's behalf, reaching services that are otherwise not directly accessible. When the optional passphrase is not enabled (factory default) configuring the URL and triggering the request require no authentication, and where the passphrase is enabled it defaults to 'opendoor'. https://www.zeroscience.mk/#/advisories/ZSL-2026-5997 Tuesday, 14 Jul 2026 00:16:00 +0200 The application's value-setting interface copies every parameter received in an HTTP request directly into its internal settings object without restricting which settings may be changed. This can be exploited to modify arbitrary configuration values that the endpoint was never intended to expose, including disabling the passphrase or changing the listening port, by supplying the corresponding parameter names. When the optional passphrase is not enabled (factory default) this requires no authentication, and where the passphrase is enabled it defaults to 'opendoor' and the same result is reachable through cross-site request forgery. https://www.zeroscience.mk/#/advisories/ZSL-2026-5996 Tuesday, 14 Jul 2026 00:15:00 +0200 The SIP Backup/Restore functionality suffers from a path traversal vulnerability. The keys in the JSON backup file which have been uploaded are not validated when they are used to generate file paths. An attacker with access to the restore feature can use the path traversal vulnerability to write JSON files outside the intended data directory. When the optional passphrase is not enabled (factory default) these actions are additionally available to any unauthenticated user, and where the passphrase is enabled it defaults to 'opendoor'. https://www.zeroscience.mk/#/advisories/ZSL-2026-5995 Tuesday, 14 Jul 2026 00:14:00 +0200 The application performs state-changing actions through HTTP GET requests without including any anti-CSRF token or validating the request origin. This can be exploited to perform administrative actions such as disabling the passphrase, rebooting the device, deleting programs or installing plugins if a logged-in administrator is lured into visiting a malicious web page. When the optional passphrase is not enabled (factory default) these actions are additionally available to any unauthenticated user, and where the passphrase is enabled it defaults to 'opendoor'. https://www.zeroscience.mk/#/advisories/ZSL-2026-5994 Tuesday, 14 Jul 2026 00:13:00 +0200 The application stores program names supplied through HTTP requests and later renders them into its web pages without proper output encoding. This can be exploited to execute arbitrary JavaScript in the browser of any user who views the affected pages by creating a program whose name contains a script payload. When the optional passphrase is not enabled (factory default) the malicious program can be created without authentication, and where the passphrase is enabled it defaults to 'opendoor'. https://www.zeroscience.mk/#/advisories/ZSL-2026-5993 Friday, 05 Jun 2026 14:42:00 +0200 Advanced-search parameters (search.*) are stuffed back into the page so the form keeps its values. Most fields apply | html, but several free-text fields do not, resulting in reflected XSS. https://www.zeroscience.mk/#/advisories/ZSL-2026-5992 Friday, 05 Jun 2026 14:42:00 +0200 The server suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server. https://www.zeroscience.mk/#/advisories/ZSL-2026-5991 Friday, 05 Jun 2026 14:41:00 +0200 Advanced-search parameters (search.*) are stuffed back into the page so the form keeps its values. Most fields apply | html, but several free-text fields do not, resulting in reflected XSS. https://www.zeroscience.mk/#/advisories/ZSL-2026-5990 Friday, 05 Jun 2026 14:41:00 +0200 Lyrion Music Server stores media file metadata tags (such as GENRE, ARTIST, and ALBUM) exactly as written in the file and later renders them in its web interface without HTML-encoding, resulting in stored cross-site scripting. An attacker who gets a file with a malicious tag into the victim's library has their payload saved during the next library scan and executed automatically whenever a user views that track's information or plays the file in the web UI. Because LMS is unauthenticated by default, the injected script runs with full access to the management interface, allowing admin commands, settings disclosure, and further exploitation. https://www.zeroscience.mk/#/advisories/ZSL-2026-5989 Friday, 05 Jun 2026 14:40:00 +0200 The log viewer reflects request parameters and raw log content into HTML with no escaping. Template Toolkit has no global auto-escaping so any [% var %] without an explicit | html filter is an injection point. The search, lines and path query parameters are reflected directly, and log lines are emitted as raw HTML. Any attacker-provided value that gets logged (a crafted URL, User-Agent, stream title, player name) becomes stored XSS. https://www.zeroscience.mk/#/advisories/ZSL-2026-5988 Friday, 05 Jun 2026 14:39:00 +0200 Lyrion Music Server suffers from an unauthenticated reflected cross-site scripting vulnerability through 'server.log' endpoint abusing the 'search' GET parameter. Input is not properly sanitized before being returned to the user, allowing the execution of arbitrary HTML/JS code in a user's browser session in the context of the affected site.