Stefan Schweighofer

Name of the Vulnerable Software and Affected Versions: Wattsense Bridge (affected versions not specified) Description: The issue allows access to the JTAG interface of Wattsense Bridge devices through physical access to the PCB. After connecting to the interface, full access to the device is possible, enabling an attacker to extract information, modify, and debug the device's firmware. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Wattsense Bridge devices versions prior to BSP 6.4.1 Description: A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. Recommendations: For versions prior to BSP 6.4.1, update to a recent firmware version BSP >= 6.4.1 to resolve the issue. As a temporary workaround, consider restricting physical access to the PCB of Wattsense Bridge devices to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Wattsense Bridge versions prior to 6.4.1 Description: The firmware of all Wattsense Bridge devices contains the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. Recommendations: For Wattsense Bridge versions prior to 6.4.1, update the firmware to version 6.4.1 or later to remove the backdoor user and hard-coded credentials. As a temporary workaround, consider restricting access to the serial interface to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Wattsense Bridge versions prior to 6.1.0 Description: An authenticated attacker can use the Plugin Manager of the web interface to upload malicious Python files, enabling remote root access to the device. The attacker needs a valid user account on the Wattsense web interface to conduct this attack. Recommendations: For versions prior to 6.1.0, update to a firmware version BSP >= 6.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the Plugin Manager or disabling the upload of Python files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** One Identity Password Manager versions prior to 5.13.1 **Description** The issue allows Kiosk Escape, affecting the product's functionality to reset Active Directory passwords on the login screen of a Windows client. It launches a Chromium-based browser in Kiosk mode. The escape sequence involves waiting for a session timeout, clicking on the Help icon, navigating to a website that offers file upload, accessing cmd.exe from the file explorer window, and launching cmd.exe as NT AUTHORITYSYSTEM. **Recommendations** For versions prior to 5.13.1, update to version 5.13.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Help icon and file upload functionality in the Kiosk mode browser to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** One Identity Password Manager versions prior to 5.13.1 **Description** The issue allows Kiosk Escape in One Identity Password Manager, which enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium-based browser in Kiosk mode to provide the reset functionality. The escape sequence involves navigating to the Google ReCAPTCHA section, clicking on the Privacy link, observing a new browser window, navigating to any website that offers file upload, navigating to cmd.exe from the file explorer window, and launching cmd.exe as NT AUTHORITYSYSTEM. **Recommendations** For versions prior to 5.13.1, update to version 5.13.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Google ReCAPTCHA section and disabling file upload functionality in the Kiosk mode browser until a patch is available. Avoid using the Kiosk mode browser to navigate to untrusted websites, and restrict the launch of cmd.exe as NT AUTHORITYSYSTEM to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SIMCom SIM7600G modem (affected versions not specified) **Description** The issue concerns an undocumented AT command in the SIMCom SIM7600G modem, allowing an attacker to execute system commands with root permission on the modem. This can be achieved with either physical access or remote shell access to a device that interacts directly with the modem via AT commands. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.