Ta-Lun Yen

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The device encrypts data using AES-CBC (Advanced Encryption Standard in Cipher Block Chaining mode) with static zero-filled Initialization Vectors (IVs). This implementation allows for known-plaintext decryption and replay attacks, where an attacker captures and re-transmits valid data packets to deceive the system. The issue is exploitable over the network without requiring authentication. **Recommendations** Replace the static zero-filled IVs with random IVs for every encryption operation.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Incoming VPN network profile settings do not safely process special characters, which allows for command injection through the use of malicious configuration files. Command injection is a technique where an attacker executes arbitrary operating system commands on the server by exploiting insufficient input validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The system Binder boundary accepts unverified pass-through AT commands. This allows local applications to read baseband files or disable cellular connectivity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, which shifts administrative ownership to an external attacker. MDM is a technology used by IT departments to monitor, manage, and secure employees' mobile devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Management API endpoints for cellular eSIM allocation fail to validate caller authorization. This flaw allows remote profiles to be rewritten or deleted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** System log files output unencrypted SMTP server authentication passwords and sensitive employee corporate identification data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The summary service endpoint is subject to an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input. The system fails to verify if the user owns the hardware serial numbers being requested, allowing unauthorized parties to scrape device data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Internal multimedia session archives are accessible without authentication. This issue is exacerbated by loose Cross-Origin Resource Sharing (CORS) rules, which allow cross-site theft. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** High-risk `TrustAllCerts` routines disable standard TLS certificate validation. When combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor—an attacker who secretly relays and possibly alters the communications between two parties—could decrypt network traffic. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), which are the machine language instructions that the CPU executes. This failure allows for the installation of unauthorized applications or the execution of arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The local MQTT broker fails to enforce topic-level Access Control Lists (ACLs), which are rules that define which clients can access specific topics. This allows any client to use wildcard characters (`#` or `+`) to enumerate hidden network devices or publish unauthorized control commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ai cmd (affected versions not specified) **Description** The `ai cmd` utility executes with full root permissions and pipes socket inputs directly to the `popen()` function. This allows unauthenticated users to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, which may lead to asset exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FieldX MDM (affected versions not specified) **Description** The adb messaging topic passes unverified payloads directly into the `Runtime.exec()` function, which enables command or instruction injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations. A Broadcast Receiver is a component that allows an application to receive and respond to system-wide broadcast announcements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Hard-coded APK resource files do not expire, and the use of a shared scepter results in information leaks and potential misuse. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The debugging routine `SCREEN CLICK(5053)` allows a connection to bypass the standard device login prompt and gain direct access to an interactive shell interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** M3WebServer (affected versions not specified) **Description** The production build hard-codes backend API keys. These keys can be intercepted by an attacker through verbose error handling pages, which display detailed system information during a failure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acer Connect M6E 5G Portable WiFi Router (affected versions not specified) **Description** Engineering diagnostics and factory-level diagnostic software are exposed on retail builds. This allows malicious applications to obtain write privileges to internal NVRAM registers, which are non-volatile memory used to store system configuration settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.