Ang Cui

**Name of the Vulnerable Software and Affected Versions** Siemens SIMATIC S7-1500 CPU Family (affected versions not specified) **Description** The issue is related to the absence of an Immutable Root of Trust in Hardware, which prevents the validation of code integrity during load-time. An attacker with physical access to the device could replace the boot image and execute arbitrary code. This could allow the attacker to bypass protected boot functions, modify the controller's working code and data. The problem is caused by architectural issues affecting Siemens Simatic and Siplus S7-1500 processors. It is estimated that over 100 device models are potentially affected. To exploit this issue, physical access to the target device is required, although it is noted that an attacker could use another Remote Code Execution vulnerability to deploy malicious firmware on the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a mitigation measure, ensure that physical access to the device is restricted to trusted personnel. New hardware versions have been released that address the issue on some affected processors, while others are in development.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone series 8800 versions prior to 2021-07-07 **Description** The issue is related to the implementation of the TrustZone technology in the microprogram software of Cisco IP Phone series 8800. It is caused by a lack of mechanism for checking the size of copied data. An unauthenticated, physically proximate attacker could achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. Exploitation is possible only when the attacker can disassemble the device to control the voltage/current for chip pins. **Recommendations** For versions prior to 2021-07-07, update the firmware to a version released after 2021-07-07 to resolve the issue. As a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco Unified IP Phone 7900 series devices (aka TNP phones) versions prior to 9.3.1-ES10 **Description** The issue is related to the kernel in Cisco Native Unix (CNU) not properly validating system calls, which can be exploited by attackers to execute arbitrary code or cause a denial of service through a crafted binary, resulting in a memory overwrite. **Recommendations** For versions prior to 9.3.1-ES10, update to version 9.3.1-ES10 or later to resolve the issue.