Enrique Nissim

Deck Mate 2 is shipped with pre-set, unchanging credentials for both the root shell and the web user interface. Multiple management services, including SSH, HTTP, Telnet, SMB, and X11, are enabled by default. An attacker gaining access to these interfaces – typically through local or nearby network connections via USB or Ethernet ports – can use these credentials to log in as an administrator and gain complete control of the system. This access allows modification of firmware utilities and controller software, potentially leading to persistent compromise. While remote access paths through networks, cellular connections, or telemetry links may exist, they generally require additional capabilities or user error. The vendor states that USB access has been disabled in recent firmware updates.

Deck Mate 1 executes firmware directly from an external EEPROM without verifying its authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to execute arbitrary code that persists across reboots. The design lacks modern secure-boot or signed-update mechanisms.

The Deck Mate 2 device does not have a verified secure-boot chain or runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem, leading to persistent code execution upon reboot. This allows for long-term firmware tampering that persists even after power cycles. The vendor has indicated that recent firmware updates improve update-chain integrity and disable physical update ports to reduce potential attack vectors.

The firmware update mechanism for Deck Mate 2 does not verify cryptographic signatures on update packages. Updates are encrypted using a single, hard-coded AES key shared across all devices and employ a truncated HMAC for integrity validation. This allows attackers with access to the update interface, typically through the USB port, to create or modify firmware packages to execute arbitrary code as root. This could lead to a persistent compromise of the device's integrity and the randomization process. Physical access or on-premises network access is the most likely attack vector, though remote exploitation is theoretically possible with misconfigured network or telemetry deployments.

The issue is related to improper validation in a model specific register (MSR) that could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution. This could give an attacker unlimited access to system memory and control over the operating system. The vulnerability is being actively exploited.

The issue is related to insufficient input validation in the System Management Mode (SMM) Supervisor firmware of AMD Ryzen processors. This could allow a remote attacker to elevate privileges and impact the integrity, availability, and confidentiality of protected information. The vulnerability may enable an attacker with a compromised SMI handler to gain Ring0 access, potentially leading to arbitrary code execution. The issue is being actively exploited.

The Dell `dbutil 2 3.sys` driver contains an insufficient access control vulnerability. This issue allows a local authenticated user to escalate privileges, cause a denial of service, or disclose protected information. In real-world incidents, the Lazarus group exploited this flaw using a Bring Your Own Vulnerable Driver (BYOVD) technique—where a legitimate but vulnerable driver is installed on the target system—to deploy the FudModule rootkit. This allowed the attackers to read and write kernel memory, effectively disabling multiple Windows security monitoring mechanisms to execute commands with kernel-level privileges. The campaign targeted individuals in the aerospace industry in the Netherlands and political journalists in Belgium via phishing emails disguised as job offers from Amazon.

The issue allows a local non-privileged malicious user to exploit a Universal Windows Platform application. This is achieved by manipulating the install software package feature, utilizing a race condition and a path traversal exploit. The goal is to run a malicious executable with elevated privileges.

An elevation of privilege issue exists due to the failure of ndis.sys to check the length of a buffer before copying memory to it. This allows attackers to affect the system.

The issue concerns the mdare64 48.sys, mdare32 48.sys, mdare32 52.sys, mdare64 52.sys, and Fortishield.sys drivers in FortiClient. These drivers do not properly restrict access to the API for management of processes and the Windows registry. This allows local users to obtain a privileged handle to a PID, which may have unspecified other impacts. An example of exploitation is a 0x2220c8 ioctl call.

The issue allows local users to write to arbitrary memory locations via a specific ioctl call, 0x226108, in certain drivers.

The issue is related to a stack-based buffer overflow in the collectoragent.exe component. This can be exploited by remote attackers who send a large PROCESS HELLO message to the Message Dispatcher on TCP port 8000, potentially allowing them to execute arbitrary code.