Yashin Mehaboobe

**Name of the Vulnerable Software and Affected Versions** Syrus4 IoT Gateway (affected versions not specified) **Description** The Syrus4 IoT gateway has an unsecured MQTT server, allowing a remote unauthenticated attacker to execute arbitrary commands on connected devices. This exposes location, video, and diagnostic data from each device. An attacker with the server's IP address can connect and perform various operations, including getting location data, sending CAN bus messages, immobilizing vehicles, accessing live video, and sending audio messages to drivers. The issue potentially affects thousands of vehicles. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HopeChart HQT-401 telematics unit version 201808021036 HopeChart HQT-401 telematics unit versions prior to the fixed version (fixed version not specified) **Description** Insufficient authentication in the MQTT backend allows an attacker to access and manipulate the telemetry data of the entire fleet of vehicles. The MQTT backend does not require authentication, allowing unauthorized connections. Vehicles publish telemetry data as messages in public topics, and the backend sends commands as MQTT posts in public topics, allowing an attacker to access confidential data. MQTT messages are not encrypted or authenticated, enabling an attacker to impersonate a vehicle or the backend and inject data into a vehicle's CAN bus by sending a specific MQTT message on a public topic. **Recommendations** For version 201808021036, consider disabling the MQTT backend until a patch is available to prevent unauthorized access. For versions prior to the fixed version, restrict access to public topics to minimize the risk of exploitation. As a temporary workaround, consider encrypting and authenticating MQTT messages to prevent impersonation. Avoid using public topics for sensitive data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Espressif ESP-IDF versions 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1 **Description** An issue allows an attacker to bypass the Secure Boot digest verification at startup using fault injection to physically disrupt the ESP32 CPU, enabling the booting of unverified code from flash. The impact is minimized if the ESP32 is configured with both Secure Boot and Flash Encryption. However, without Flash Encryption, successful fault injection can lead to arbitrary code execution. **Recommendations** For versions 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1, to protect against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.