Alex Plaskett

**Name of the Vulnerable Software and Affected Versions** Tesla Telematics Control Unit (TCU) firmware versions prior to 2025.14 **Description** The Tesla Telematics Control Unit (TCU) firmware is susceptible to an authentication bypass. The TCU operates the Android Debug Bridge (adbd) with root privileges. Despite a security check intended to disable adb shell access, adb push/pull and adb forward functionalities remain accessible. An attacker with physical access can exploit this by writing an arbitrary file to a writable location and subsequently overwriting the kernel’s `uevent helper` or `/proc/sys/kernel/hotplug` entries through ADB. This allows for the execution of scripts with root privileges. **Recommendations** Update Tesla Telematics Control Unit (TCU) firmware to version 2025.14 or later.

**Name of the Vulnerable Software and Affected Versions** Pioneer DMH-WT7600NEX (affected versions not specified) **Description** This issue allows network-adjacent attackers to create arbitrary files on affected installations. Although authentication is required to exploit this, the existing authentication mechanism can be bypassed. The specific flaw exists within the telematics functionality and results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pioneer DMH-WT7600NEX (affected versions not specified) **Description** This issue allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pioneer DMH-WT7600NEX devices. No authentication is required to exploit this issue. The specific flaw exists within the telematics functionality, which operates over HTTPS. The problem results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this, in conjunction with other vulnerabilities, to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Alpine Halo9 (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this issue. The specific flaw exists within the `UPDM wemCmdUpdFSpeDecomp` function, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Alpine Halo9 (affected versions not specified) **Description** This issue allows physically present attackers to bypass the signature validation mechanism on affected installations of Alpine Halo9 devices. No authentication is required to exploit this issue. The flaw exists within the firmware metadata signature validation mechanism due to the lack of proper verification of a cryptographic signature. An attacker can leverage this, potentially in conjunction with other issues, to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Phoenix Contact CHARX SEC-3100 CharxUpdateAgent (affected versions not specified) **Description** An unauthenticated remote attacker can upload an arbitrary script file due to improper input validation. The upload destination is fixed and is write only. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 (affected versions not specified) Description: The issue is related to improper input validation and a missing authentication procedure, allowing an unauthenticated remote attacker to modify configurations. This can lead to remote code execution, gaining root rights, or performing a Denial of Service (DoS). The vulnerability is associated with the CharxSystemConfigManager service of the Phoenix Contact CHARX SEC-3100 modular charging controllers. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netatalk (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this issue. The specific flaw exists within the `parse entries` function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this issue to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Lexmark devices (affected versions not specified) **Description** The issue concerns a PJL directory traversal vulnerability that can be leveraged to overwrite internal configuration files. This vulnerability affects Lexmark devices and can potentially be used for remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.3 iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 tvOS versions prior to 14.5 **Description** The issue is related to an out-of-bounds read in the kernel, which can be exploited by a malicious application to disclose kernel memory. This could allow a remote attacker to gain unauthorized access to protected information. **Recommendations** For macOS versions prior to 11.3, update to macOS Big Sur 11.3. For iOS versions prior to 14.5, update to iOS 14.5. For iPadOS versions prior to 14.5, update to iPadOS 14.5. For watchOS versions prior to 7.4, update to watchOS 7.4. For tvOS versions prior to 14.5, update to tvOS 14.5.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.0.1 tvOS versions prior to 14.0 macOS Big Sur versions prior to 11.1 macOS Catalina versions prior to Security Update 2020-001 macOS Mojave versions prior to Security Update 2020-007 watchOS versions prior to 7.0 iOS versions prior to 14.0 iPadOS versions prior to 14.0 **Description** Multiple memory corruption issues were addressed with improved input validation. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory. **Recommendations** For macOS versions prior to 11.0.1, update to macOS Big Sur 11.0.1 or later. For tvOS versions prior to 14.0, update to tvOS 14.0 or later. For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1 or later. For macOS Catalina versions prior to Security Update 2020-001, apply Security Update 2020-001 or later. For macOS Mojave versions prior to Security Update 2020-007, apply Security Update 2020-007 or later. For watchOS versions prior to 7.0, update to watchOS 7.0 or later. For iOS versions prior to 14.0, update to iOS 14.0 or later. For iPadOS versions prior to 14.0, update to iPadOS 14.0 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 13.4 iPadOS versions prior to 13.4 macOS Catalina versions prior to 10.15.4 tvOS versions prior to 13.4 watchOS versions prior to 6.2 **Description** A memory initialization issue was addressed with improved memory handling. A malicious application may be able to execute arbitrary code with kernel privileges. **Recommendations** For iOS versions prior to 13.4, update to iOS 13.4 or later. For iPadOS versions prior to 13.4, update to iPadOS 13.4 or later. For macOS Catalina versions prior to 10.15.4, update to macOS Catalina 10.15.4 or later. For tvOS versions prior to 13.4, update to tvOS 13.4 or later. For watchOS versions prior to 6.2, update to watchOS 6.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.4 Safari versions prior to 11.1.1 iCloud versions prior to 7.5 on Windows iTunes versions prior to 12.7.5 on Windows tvOS versions prior to 11.4 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, resulting in a buffer overflow and application crash. **Recommendations** For iOS versions prior to 11.4, update to version 11.4 or later. For Safari versions prior to 11.1.1, update to version 11.1.1 or later. For iCloud versions prior to 7.5 on Windows, update to version 7.5 or later. For iTunes versions prior to 12.7.5 on Windows, update to version 12.7.5 or later. For tvOS versions prior to 11.4, update to version 11.4 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.13.5 **Description** The issue is related to the Accessibility Framework component and involves insufficient access restrictions. Exploitation of this issue may allow an attacker to execute arbitrary code with system privileges or disclose protected information using a specially crafted application. **Recommendations** For macOS versions prior to 10.13.5, update to version 10.13.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Accessibility Framework component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Samsung Members versions prior to 2.4.25 **Description** This issue allows remote attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of Intents, specifically in the ability to send an Intent that would not otherwise be reachable. This can be leveraged to escalate privileges to resources normally protected from the application. **Recommendations** For versions prior to 2.4.25, update to version 2.4.25 to resolve the issue. As a temporary workaround, consider restricting the handling of Intents to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Samsung Galaxy Apps versions prior to 4.2.18.2 Description: This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of a staging mode, specifically in the ability to change the configuration based on the presence of a file in a user-controlled location. This can be leveraged to escalate privileges to resources normally protected from the application. Recommendations: For versions prior to 4.2.18.2, update to version 4.2.18.2 to resolve the issue. As a temporary workaround, consider restricting access to the staging mode to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 2.0.02.31 Description: This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of ZIP files, specifically due to the lack of proper validation of a user-supplied path prior to using it in file operations. This allows an attacker to escalate privileges to resources normally protected from the application. Recommendations: For versions prior to 2.0.02.31, update to version 2.0.02.31 or later to resolve the issue. As a temporary workaround, consider restricting the handling of ZIP files until a patch is applied. Avoid using user-supplied paths in file operations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.13.2 **Description** The issue involves the `IOKit` component and allows attackers to execute arbitrary code in a privileged context via a crafted app. **Recommendations** For macOS versions prior to 10.13.2, update to version 10.13.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.13 iOS versions prior to 11 tvOS versions prior to 11 watchOS versions prior to 4 **Description** The issue is caused by a buffer overflow in the memory of the Kernel component of Mac OS X and iOS operating systems. This allows a remote attacker to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) using a specially crafted app. **Recommendations** For macOS versions prior to 10.13, update to version 10.13 or later. For iOS versions prior to 11, update to version 11 or later. For tvOS versions prior to 11, update to version 11 or later. For watchOS versions prior to 4, update to version 4 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.6 **Description** The issue involves the `Bluetooth` component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This is caused by a buffer overflow in the Bluetooth component of the Mac OS X operating system. **Recommendations** For macOS versions prior to 10.12.6, update to version 10.12.6 or later to resolve the issue. As a temporary workaround, consider disabling the Bluetooth component until a patch is available. Restrict access to Bluetooth functionality to minimize the risk of exploitation.