Helo Plus
Monthly
Decryption of sensitive diagnostics bundles in AJA HELO Plus firmware before 2.1.7 allows unauthenticated remote attackers to recover highly sensitive server information from any device they can reach. The firmware embeds a static AES passphrase in obfuscated form, so an attacker who reverse engineers the publicly available firmware image once can decrypt diagnostics exports pulled from the unauthenticated diagnostics endpoint on every affected device. Exploitation requires no authentication, no user interaction, and no non-default configuration, with network reachability to the device's management/diagnostics interface as the primary limiting factor; no public exploit code has been identified at time of analysis, and a vendor fix is available in firmware 2.1.7.
Stored cross-site scripting in AJA HELO Plus firmware before 2.1.7 lets an unauthenticated attacker with network access to the device's web configuration API write a malicious JavaScript payload into the eParamID_SystemName field via /config?action=set, which then executes in the browser of any administrator who opens the management interface. The write path is only reachable when device authentication is disabled, making that an operator-chosen configuration the primary gating condition, and successful exploitation requires a victim administrator to load the interface (UI:P passive interaction). Impact is limited to hijacking the authenticated session and exfiltrating stored secrets - web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials - rather than code execution on the device itself; no public exploit identified at time of analysis, and the vendor has released firmware 2.1.7 as the fix.
Decryption of sensitive diagnostics bundles in AJA HELO Plus firmware before 2.1.7 allows unauthenticated remote attackers to recover highly sensitive server information from any device they can reach. The firmware embeds a static AES passphrase in obfuscated form, so an attacker who reverse engineers the publicly available firmware image once can decrypt diagnostics exports pulled from the unauthenticated diagnostics endpoint on every affected device. Exploitation requires no authentication, no user interaction, and no non-default configuration, with network reachability to the device's management/diagnostics interface as the primary limiting factor; no public exploit code has been identified at time of analysis, and a vendor fix is available in firmware 2.1.7.
Stored cross-site scripting in AJA HELO Plus firmware before 2.1.7 lets an unauthenticated attacker with network access to the device's web configuration API write a malicious JavaScript payload into the eParamID_SystemName field via /config?action=set, which then executes in the browser of any administrator who opens the management interface. The write path is only reachable when device authentication is disabled, making that an operator-chosen configuration the primary gating condition, and successful exploitation requires a victim administrator to load the interface (UI:P passive interaction). Impact is limited to hijacking the authenticated session and exfiltrating stored secrets - web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials - rather than code execution on the device itself; no public exploit identified at time of analysis, and the vendor has released firmware 2.1.7 as the fix.