This was a relatively light Christmas week for disclosures. We have seven vendor disclosures from Delta Electronics, Eaton (3), Hitachi (2), and Ruckus. We also have four exploits for products from FortiGuard, HP (2), and HPE.
Delta Advisory
Delta published an advisory that describes a cleartext transmission of sensitive information in their DVP-12SE PLC. The vulnerability was reported by Praneeta Krishnaprasad Maganti of BITS Pilani. Delta provides generic mitigation measures.
Eaton Advisories
Eaton published an advisory that describes an uncontrolled search path vulnerability in their UPS Companion (EUC) Software. The vulnerability was reported by Kazuma Matsumoto. Eaton has a new version that mitigates the vulnerability.
Eaton published an advisory that describes two uncontrolled search path element vulnerabilities in their UPS Companion (EUC) software. Eaton has a new version that mitigates the vulnerabilities.
Eaton published an advisory that describes an improper input validation vulnerability in their xComfort ECI. The vulnerability was reported by Mihkal Dunfjeld. Eaton reports that the product has been declared end-of-life, no fix is planned. Eaton provides generic mitigation measures.
Hitachi Advisories
Hitachi published an advisory that discusses two vulnerabilities in their Infrastructure Analytics Advisor and Ops Center Analyzer products. Hitachi has a new version for their Ops Center Analyzer product that mitigates the vulnerability.
The two reported vulnerabilities are:
Cross-site scripting - CVE-2025-66444, and
Authorization bypass - CVE-2025-6644.
Hitachi published an advisory that discusses 35 vulnerabilities in their Disk Array products. These are third-party (Microsoft) vulnerabilities. Hitachi has new versions that mitigate the vulnerabilities.
Ruckus Advisory
Ruckus published an advisory that discusses the Qualcomm U-boot vulnerability. Ruckus reports that none of their products are affected.
FortiGuard Exploit
Indoushka published an exploit for an SQL injection vulnerability in the FortiGuard FortiWeb Fabric Connector. The vulnerability was previously reported by FortiGuard, and is listed on CISA’s Known Exploited Vulnerabilities catalog.
HP Exploits
Indoushka published an exploit for a PHP code injection vulnerability in the HP ProCurve SNAC Domain Controller. There is no CVE mentioned, nor is there any indication that the vendor has been notified of the vulnerability. This may be a 0-day vulnerability.
Indoushka published an exploit for a credential dumping attack on the HP ProCurve SNAC Domain Controller. There is no CVE mentioned, nor is there any indication that the vendor has been notified of the vulnerability. This may be a 0-day vulnerability.
HPE Exploit
Remmons-r7, et al, published a Metasploit module for a code injection vulnerability in the HPE One View product. HPE previously disclosed the vulnerability.