Ethan Shackelford

Deck Mate 2 is shipped with pre-set, unchanging credentials for both the root shell and the web user interface. Multiple management services, including SSH, HTTP, Telnet, SMB, and X11, are enabled by default. An attacker gaining access to these interfaces – typically through local or nearby network connections via USB or Ethernet ports – can use these credentials to log in as an administrator and gain complete control of the system. This access allows modification of firmware utilities and controller software, potentially leading to persistent compromise. While remote access paths through networks, cellular connections, or telemetry links may exist, they generally require additional capabilities or user error. The vendor states that USB access has been disabled in recent firmware updates.

The firmware update mechanism for Deck Mate 2 does not verify cryptographic signatures on update packages. Updates are encrypted using a single, hard-coded AES key shared across all devices and employ a truncated HMAC for integrity validation. This allows attackers with access to the update interface, typically through the USB port, to create or modify firmware packages to execute arbitrary code as root. This could lead to a persistent compromise of the device's integrity and the randomization process. Physical access or on-premises network access is the most likely attack vector, though remote exploitation is theoretically possible with misconfigured network or telemetry deployments.

The Deck Mate 2 device does not have a verified secure-boot chain or runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem, leading to persistent code execution upon reboot. This allows for long-term firmware tampering that persists even after power cycles. The vendor has indicated that recent firmware updates improve update-chain integrity and disable physical update ports to reduce potential attack vectors.

Deck Mate 1 executes firmware directly from an external EEPROM without verifying its authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to execute arbitrary code that persists across reboots. The design lacks modern secure-boot or signed-update mechanisms.

This issue allows an authenticated attacker to execute OS commands on the device via the 'php/dal.php' endpoint, in the `arrSaveConfig` parameter.

The issue is related to an OS command injection vulnerability in the XML API of PAN-OS software. This vulnerability exists due to the lack of neutralization of special elements used in the OS command. An authenticated API user can exploit this vulnerability to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.