Alexander Bolshev

**Name of the Vulnerable Software and Affected Versions** Dell/Alienware Digital Delivery versions prior to 4.0.41 **Description** The issue allows a local non-privileged malicious user to exploit a Universal Windows Platform application. This is achieved by manipulating the install software package feature, utilizing a race condition and a path traversal exploit. The goal is to run a malicious executable with elevated privileges. **Recommendations** For versions prior to 4.0.41, update to version 4.0.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the install software package feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SIMATIC WinCC OA UI for Android versions prior to V3.15.10 SIMATIC WinCC OA UI for iOS versions prior to V3.15.10 **Description** A security issue has been identified due to insufficient limitation of CONTROL script capabilities, allowing read and write access between HMI project cache folders within the app's sandbox on the same mobile device. This could be exploited by an attacker who tricks a user into connecting to a controlled server, requiring user interaction and access to the app's folder. The issue could allow data reading and writing to the app's folder. No public exploitation was known at the time of publication. **Recommendations** For SIMATIC WinCC OA UI for Android versions prior to V3.15.10, update to version V3.15.10 or later. For SIMATIC WinCC OA UI for iOS versions prior to V3.15.10, update to version V3.15.10 or later.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric IMT25 Magnetic Flow DTM versions prior to 1.500.004 **Description** The issue allows remote authenticated users to execute arbitrary code or cause a denial of service due to memory corruption via a crafted HART reply. This is a result of a buffer overflow in the HART Protocol. **Recommendations** For versions prior to 1.500.004, update to version 1.500.004 or later to resolve the issue. As a temporary workaround, consider restricting access to the HART Protocol to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CodeWrights HART Comm DTM components (affected versions not specified) **Description** The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.