deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39862
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: fix list corruption after hardware restart

Since stations are recreated from scratch, all lists that wcids are added
to must be cleared before calling ieee80211_restart_hw.
Set wcid->sta = 0 for each wcid entry in order to ensure that they are
not added again before they are ready.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774; https://git.kernel.org/stable/c/8fa8eb52bc2eb08d93202863b5fc478e0bebc00c
CVE: CVE-2025-39863
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

The brcmf_btcoex_detach() only shuts down the btcoex timer, if the
flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which
runs as timer handler, sets timer_on to false. This creates critical
race conditions:

1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()
is executing, it may observe timer_on as false and skip the call to
timer_shutdown_sync().

2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info
worker after the cancel_work_sync() has been executed, resulting in
use-after-free bugs.

The use-after-free bugs occur in two distinct scenarios, depending on
the timing of when the brcmf_btcoex_info struct is freed relative to
the execution of its worker thread.

Scenario 1: Freed before the worker is scheduled

The brcmf_btcoex_info is deallocated before the worker is scheduled.
A race condition can occur when schedule_work(&bt_local->work) is
called after the target memory has been freed. The sequence of events
is detailed below:

CPU0                           | CPU1
brcmf_btcoex_detach            | brcmf_btcoex_timerfunc
                               |   bt_local->timer_on = false;
  if (cfg->btcoex->timer_on)   |
    ...                        |
  cancel_work_sync();          |
  ...                          |
  kfree(cfg->btcoex); // FREE  |
                               |   schedule_work(&bt_local->work); // USE

Scenario 2: Freed after the worker is scheduled

The brcmf_btcoex_info is freed after the worker has been scheduled
but before or during its execution. In this case, statements within
the brcmf_btcoex_handler() — such as the container_of macro and
subsequent dereferences of the brcmf_btcoex_info object will cause
a use-after-free access. The following timeline illustrates this
scenario:

CPU0                            | CPU1
brcmf_btcoex_detach             | brcmf_btcoex_timerfunc
                                |   bt_local->timer_on = false;
  if (cfg->btcoex->timer_on)    |
    ...                         |
  cancel_work_sync();           |
  ...                           |   schedule_work(); // Reschedule
                                |
  kfree(cfg->btcoex); // FREE   |   brcmf_btcoex_handler() // Worker
  /*                            |     btci = container_of(....); // USE
   The kfree() above could      |     ...
   also occur at any point      |     btci-> // USE
   during the worker's execution|
   */                           |

To resolve the race conditions, drop the conditional check and call
timer_shutdown_sync() directly. It can deactivate the timer reliably,
regardless of its current state. Once stopped, the timer_on state is
then set to false.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625; https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7; https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc
CVE: CVE-2025-39864
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix use-after-free in cmp_bss()

Following bss_free() quirk introduced in commit 776b3580178f
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/26e84445f02ce6b2fe5f3e0e28ff7add77f35e08; https://git.kernel.org/stable/c/5b7ae04969f822283a95c866967e42b4d75e0eef; https://git.kernel.org/stable/c/6854476d9e1aeaaf05ebc98d610061c2075db07d
CVE: CVE-2025-39865
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

tee: fix NULL pointer dereference in tee_shm_put

tee_shm_put have NULL pointer dereference:

__optee_disable_shm_cache -->
	shm = reg_pair_to_ptr(...);//shm maybe return NULL
        tee_shm_free(shm); -->
		tee_shm_put(shm);//crash

Add check in tee_shm_put to fix it.

panic log:
Unable to handle kernel paging request at virtual address[PII_REDACTED]100cca
Mem abort info:
ESR = 0x[PII_REDACTED]000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]d07000
[[PII_REDACTED]100cca] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
Internal error: Oops: [PII_REDACTED] [#1] SMP
CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ----
6.6.0-39-generic #38
Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07
Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0
10/26/2022
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : tee_shm_put+0x24/0x188
lr : tee_shm_free+0x14/0x28
sp : ffff001f98f9faf0
x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: [PII_REDACTED]
x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048
x23: ffff001f850fcd18 x22: [PII_REDACTED] x21: ffff001f98f9fb88
x20: ffff001f83e76218 x19: ffff001f83e761e0 x18:[PII_REDACTED]00ffff
x17: 303a30303a303030 x16: [PII_REDACTED] x15: [PII_REDACTED]
x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : ffff800080e08d0c
x8 : ffff001f98f9fb88 x7 : [PII_REDACTED] x6 : [PII_REDACTED]
x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 :[PII_REDACTED]100cca
Call trace:
tee_shm_put+0x24/0x188
tee_shm_free+0x14/0x28
__optee_disable_shm_cache+0xa8/0x108
optee_shutdown+0x28/0x38
platform_shutdown+0x28/0x40
device_shutdown+0x144/0x2b0
kernel_power_off+0x3c/0x80
hibernate+0x35c/0x388
state_store+0x64/0x80
kobj_attr_store+0x14/0x28
sysfs_kf_write+0x48/0x60
kernfs_fop_write_iter+0x128/0x1c0
vfs_write+0x270/0x370
ksys_write+0x6c/0x100
__arm64_sys_write+0x20/0x30
invoke_syscall+0x4c/0x120
el0_svc_common.constprop.0+0x44/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x24/0x88
el0t_64_sync_handler+0x134/0x150
el0t_64_sync+0x14c/0x15
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/25e315bc8ad363bd1194e49062f183ad4011957e; https://git.kernel.org/stable/c/4377eac565c297fdfccd2f8e9bf94ee84ff6172f; https://git.kernel.org/stable/c/5e07a4235bb85d9ef664411e4ff4ac34783c18ff
CVE: CVE-2025-39866
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

fs: writeback: fix use-after-free in __mark_inode_dirty()

An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.

CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
 __mark_inode_dirty+0x124/0x418
 generic_update_time+0x4c/0x60
 file_modified+0xcc/0xd0
 ext4_buffered_write_iter+0x58/0x124
 ext4_file_write_iter+0x54/0x704
 vfs_write+0x1c0/0x308
 ksys_write+0x74/0x10c
 __arm64_sys_write+0x1c/0x28
 invoke_syscall+0x48/0x114
 el0_svc_common.constprop.0+0xc0/0xe0
 do_el0_svc+0x1c/0x28
 el0_svc+0x40/0xe4
 el0t_64_sync_handler+0x120/0x12c
 el0t_64_sync+0x194/0x198

Root cause is:

systemd-random-seed                         kworker
----------------------------------------------------------------------
___mark_inode_dirty                     inode_switch_wbs_work_fn

  spin_lock(&inode->i_lock);
  inode_attach_wb
  locked_inode_to_wb_and_lock_list
     get inode->i_wb
     spin_unlock(&inode->i_lock);
     spin_lock(&wb->list_lock)
  spin_lock(&inode->i_lock)
  inode_io_list_move_locked
  spin_unlock(&wb->list_lock)
  spin_unlock(&inode->i_lock)
                                    spin_lock(&old_wb->list_lock)
                                      inode_do_switch_wbs
                                        spin_lock(&inode->i_lock)
                                        inode->i_wb = new_wb
                                        spin_unlock(&inode->i_lock)
                                    spin_unlock(&old_wb->list_lock)
                                    wb_put_many(old_wb, nr_switched)
                                      cgwb_release
                                      old wb released
  wb_wakeup_delayed() accesses wb,
  then trigger the use-after-free
  issue

Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1edc2feb9c759a9883dfe81cb5ed231412d8b2e4; https://git.kernel.org/stable/c/b187c976111960e6e54a6b1fff724f6e3d39406c; https://git.kernel.org/stable/c/bf89b1f87c72df79cf76203f71fbf8349cd5c9de
CVE: CVE-2025-55910
Published: 2025-09-19
Description: CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-459
References: https://github.com/Y4y17/CVE/blob/main/CMSEasy/Arbitrary%20file%20deletion%20vulnerability.md
CVE: CVE-2025-56869
Published: 2025-09-19
Description: Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in backend/src/applications/files/services/files-manager.service.ts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Sync-in/server; https://github.com/Sync-in/server/releases/tag/v1.2.0; https://sync-in.com/
CVE: CVE-2025-57296
Published: 2025-09-19
Description: Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the sub_ADBC0 helper function concatenates these user-supplied values into nvram set system commands using doSystemCmd, without validating or sanitizing special characters (e.g., ;, ", #). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbitrary system command execution on the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/ZZ2266/.github.io/blob/main/Tenda/readme.md; https://github.com/ZZ2266/.github.io/tree/main/Tenda; https://tenda.com.cn/material/show/2681
CVE: CVE-2025-57644
Published: 2025-09-19
Description: Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write and server-side request forgery (SSRF), enabling interaction with internal or external systems. Successful exploitation can lead to full server compromise, unauthorized access to sensitive data, and further network exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-22, CWE-94, CWE-918
References: https://medium.com/@anvarkh/cve-2025-57644-remote-code-execution-ssrf-in-accela-eedc6bc4adfb; https://www.accela.com
CVE: CVE-2025-59344
Published: 2025-09-19
Description: AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows <link rel="icon" href="…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968; https://github.com/aliasvault/aliasvault/pull/1226; https://github.com/aliasvault/aliasvault/releases/tag/0.23.1
CVE: CVE-2025-59427
Published: 2025-09-19
Description: The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
CWE: CWE-200
References: https://github.com/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38; https://github.com/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773; https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx
CVE: CVE-2025-36248
Published: 2025-09-19
Description: IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7245562
CVE: CVE-2025-10721
Published: 2025-09-19
Description: A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml. This manipulation causes improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/org.dayup.stocks.md; https://github.com/KMov-g/androidapps/blob/main/org.dayup.stocks.md#steps-to-reproduce; https://vuldb.com/?ctiid.325010
CVE: CVE-2025-10722
Published: 2025-09-19
Description: A vulnerability was detected in SKTLab Mukbee App 1.01.196 on Android. This affects an unknown function of the file AndroidManifest.xml of the component com.dw.android.mukbee. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.dw.android.mukbee.md; https://github.com/KMov-g/androidapps/blob/main/com.dw.android.mukbee.md#steps-to-reproduce; https://vuldb.com/?ctiid.325015
CVE: CVE-2025-48703
Published: 2025-09-19
Description: CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://fenrisk.com/rce-centos-webpanel; https://control-webpanel.com/changelog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703
CVE: CVE-2022-4980
Published: 2025-09-19
Description: General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation / first-admin creation page and create a new administrative account remotely. By gaining admin privileges, the attacker can change the ATM configuration resulting in redirected funds. Public vendor advisories and multiple independent writeups describe the vulnerability as a call to the page used for initial/default installation / first administration user creation; General Bytes has not publicly published the exact endpoint/parameter name. The issue was actively exploited in the wild against cloud-hosted and standalone CAS deployments (scanning exposed CAS instances on ports 7777/443), and publicly acknowledged by the General Bytes in September 2022.
CWE: CWE-306
References: https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/[PII_REDACTED]/Security%2BIncident%2B; https://news.sophos.com/en-us/2022/08/23/bitcoin-atms-leeched-by-attackers-who-created-fake-admin-accounts/; https://thehackernews.com/2022/08/hackers-stole-crypto-from-bitcoin-atms.html
CVE: CVE-2024-13990
Published: 2025-09-19
Description: MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle (MitM) attack and substitute malicious update payloads for legitimate ones. The eScan AV client accepted these substituted packages and executed or loaded their components (including sideloaded DLLs and Java/installer payloads), enabling remote code execution on affected systems. MicroWorld eScan confirmed remediation of the update mechanism on 2023-07-31 but versioning details are unavailable. NOTE: MicroWorld eScan disputes the characterization in third-party reports, stating the issue relates to 2018–2019 and that controls were implemented then.
CWE: CWE-295, CWE-347
References: https://arstechnica.com/security/2024/04/hackers-infect-users-of-antivirus-service-that-delivered-updates-over-http/; https://blog.avast.com/leading-the-charge-against-guptiminer; https://securityaffairs.com/162228/breaking-news/escan-antivirus-mitm-attack.html
CVE: CVE-2025-26514
Published: 2025-09-19
Description: StorageGRID (formerly 
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are 
susceptible to a Reflected Cross-Site Scripting vulnerability. 
Successful exploit could allow an attacker to view or modify 
configuration settings or add or modify user accounts but requires the 
attacker to know specific information about the target instance and then
 trick a privileged user into clicking a specially crafted link.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2025-26515
Published: 2025-09-19
Description: StorageGRID (formerly 
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without 
Single Sign-on enabled are susceptible to a Server-Side Request Forgery 
(SSRF) vulnerability. Successful exploit could allow an unauthenticated 
attacker to change the password of any Grid Manager or Tenant Manager 
non-federated user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2025-26516
Published: 2025-09-19
Description: StorageGRID (formerly 
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are 
susceptible to a Denial of Service vulnerability. Successful exploit 
could allow an unauthenticated attacker to cause a Denial of Service on 
the Admin node.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-405
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2025-26517
Published: 2025-09-19
Description: StorageGRID (formerly 
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are 
susceptible to a privilege escalation vulnerability. Successful exploit 
could allow an unauthorized authenticated attacker to discover Grid node
 names and IP addresses or modify Storage Grades.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2025-34188
Published: 2025-09-19
Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel_session, are stored in cleartext within world-readable log files. Any local user with access to the machine can extract these session tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials, potentially leading to unauthorized system access and exposure of sensitive information. This vulnerability has been identified by the vendor as: V-2022-008 — Secrets Leaked in Logs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#mac-leak-secrets
CVE: CVE-2025-34189
Published: 2025-09-19
Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInstallerClient/tmp with world-readable and world-writable permissions. Any local user can craft malicious request files that are processed by privileged daemons, leading to unauthorized actions being executed in other user sessions. This breaks user session isolation, potentially allowing local attackers to hijack sessions, perform unintended actions in the context of other users, and impact system integrity and availability. This vulnerability has been identified by the vendor as: V-2022-004 — Client Inter-process Security.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-922
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#mac-lack-auth-communication