Enrique Nissim

**Name of the Vulnerable Software and Affected Versions** Deck Mate 2 (affected versions not specified) **Description** Deck Mate 2 is shipped with pre-set, unchanging credentials for both the root shell and the web user interface. Multiple management services, including SSH, HTTP, Telnet, SMB, and X11, are enabled by default. An attacker gaining access to these interfaces – typically through local or nearby network connections via USB or Ethernet ports – can use these credentials to log in as an administrator and gain complete control of the system. This access allows modification of firmware utilities and controller software, potentially leading to persistent compromise. While remote access paths through networks, cellular connections, or telemetry links may exist, they generally require additional capabilities or user error. The vendor states that USB access has been disabled in recent firmware updates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Deck Mate 1 (affected versions not specified) **Description** Deck Mate 1 executes firmware directly from an external EEPROM without verifying its authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to execute arbitrary code that persists across reboots. The design lacks modern secure-boot or signed-update mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Deck Mate 2 (affected versions not specified) **Description** The Deck Mate 2 device does not have a verified secure-boot chain or runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem, leading to persistent code execution upon reboot. This allows for long-term firmware tampering that persists even after power cycles. The vendor has indicated that recent firmware updates improve update-chain integrity and disable physical update ports to reduce potential attack vectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Deck Mate 2 (affected versions not specified) **Description** The firmware update mechanism for Deck Mate 2 does not verify cryptographic signatures on update packages. Updates are encrypted using a single, hard-coded AES key shared across all devices and employ a truncated HMAC for integrity validation. This allows attackers with access to the update interface, typically through the USB port, to create or modify firmware packages to execute arbitrary code as root. This could lead to a persistent compromise of the device's integrity and the randomization process. Physical access or on-premises network access is the most likely attack vector, though remote exploitation is theoretically possible with misconfigured network or telemetry deployments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD EPYC Processors (affected versions not specified) AMD Ryzen Processors (affected versions not specified) AMD Threadripper Processors (affected versions not specified) **Description** The issue is related to improper validation in a model specific register (MSR) that could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution. This could give an attacker unlimited access to system memory and control over the operating system. The vulnerability is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD Ryzen (affected versions not specified) **Description** The issue is related to insufficient input validation in the System Management Mode (SMM) Supervisor firmware of AMD Ryzen processors. This could allow a remote attacker to elevate privileges and impact the integrity, availability, and confidentiality of protected information. The vulnerability may enable an attacker with a compromised SMI handler to gain Ring0 access, potentially leading to arbitrary code execution. The issue is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell dbutil 2 3.sys driver (affected versions not specified) **Description** The Dell dbutil 2 3.sys driver contains an insufficient access control vulnerability, which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required. This issue has been exploited by the Lazarus group in a spy campaign, where they used a technique called Bring Your Own Vulnerable Driver (BYOVD) to install a legitimate but vulnerable driver on the victim's device. The vulnerability was then exploited to read and write kernel memory, allowing the attackers to disable security monitoring and execute commands with kernel-level privileges. The campaign targeted individuals in the aerospace industry in the Netherlands and political journalists in Belgium. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell/Alienware Digital Delivery versions prior to 4.0.41 **Description** The issue allows a local non-privileged malicious user to exploit a Universal Windows Platform application. This is achieved by manipulating the install software package feature, utilizing a race condition and a path traversal exploit. The goal is to run a malicious executable with elevated privileges. **Recommendations** For versions prior to 4.0.41, update to version 4.0.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the install software package feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers **Description** An elevation of privilege issue exists due to the failure of ndis.sys to check the length of a buffer before copying memory to it. This allows attackers to affect the system. **Recommendations** For Windows 7, update to a version that includes the fix for this issue. For Windows Server 2012 R2, update to a version that includes the fix for this issue. For Windows RT 8.1, update to a version that includes the fix for this issue. For Windows Server 2012, update to a version that includes the fix for this issue. For Windows 8.1, update to a version that includes the fix for this issue. For Windows Server 2016, update to a version that includes the fix for this issue. For Windows Server 2008 R2, update to a version that includes the fix for this issue. For Windows 10, update to a version that includes the fix for this issue. For Windows 10 Servers, update to a version that includes the fix for this issue.

**Name of the Vulnerable Software and Affected Versions** FortiClient versions prior to 5.2.4 **Description** The issue concerns the mdare64 48.sys, mdare32 48.sys, mdare32 52.sys, mdare64 52.sys, and Fortishield.sys drivers in FortiClient. These drivers do not properly restrict access to the API for management of processes and the Windows registry. This allows local users to obtain a privileged handle to a PID, which may have unspecified other impacts. An example of exploitation is a 0x2220c8 ioctl call. **Recommendations** For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the management API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FortiClient versions prior to 5.2.4 **Description** The issue allows local users to write to arbitrary memory locations via a specific ioctl call, 0x226108, in certain drivers. **Recommendations** For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Fortinet Single Sign On (FSSO) versions prior to build 164 **Description** The issue is related to a stack-based buffer overflow in the collectoragent.exe component. This can be exploited by remote attackers who send a large PROCESS HELLO message to the Message Dispatcher on TCP port 8000, potentially allowing them to execute arbitrary code. **Recommendations** For versions prior to build 164, update to build 164 or later to resolve the issue. As a temporary workaround, consider restricting access to the Message Dispatcher on TCP port 8000 to minimize the risk of exploitation.