J. Alex Halderman

**Name of the Vulnerable Software and Affected Versions** Democracy Suite versions 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15 **Description** A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. **Recommendations** For versions 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15, consider updating to a version that includes an improved pseudo random number algorithm, such as version 5.17 or later, as mentioned in the Democracy Suite 5.17 EAC Certificate of Conformance. At the moment, there is no other information about a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting System ImageCast X (affected versions not specified) **Description** The issue is related to the manipulation of Dominion Voting System ImageCast X devices through specially crafted election definition files, allowing for arbitrary code execution. An attacker could leverage this to spread malicious code to ImageCast X devices from the EMS. The vulnerability is also associated with insufficient path checking for a directory with restricted access, which can be exploited to execute arbitrary code using a specially crafted ballot file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The authentication mechanism used by voters to activate a voting session is susceptible to forgery. An attacker could leverage this issue to print an arbitrary number of ballots without authorization. The vulnerability is related to a lack in the source data confirmation mechanism, which can be exploited to obtain ballots without proper authorization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The issue is related to errors in access control, allowing an attacker to execute arbitrary code with elevated privileges by exploiting a system-level service. This could enable the attacker to escalate privileges on a device and/or install malicious code. The vulnerability can be exploited by leveraging a specially crafted binary file with the setuid flag. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The issue is related to inadequate protection of an alternative path in the ImageCast X device software, allowing an attacker to reboot the device into Android Safe Mode. This enables direct access to the operating system, potentially permitting an attacker to escalate privileges on the device and/or install malicious code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The issue is related to the authentication mechanism used by administrators of the ImageCast X device, which is associated with errors in privilege assignment. This could allow an attacker to elevate their privileges. The vulnerability may expose cryptographic secrets used to protect election information, potentially giving an attacker access to sensitive information and allowing them to perform privileged actions, which could affect other election equipment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The authentication mechanism used by technicians on the Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physical access may use this to gain administrative privileges on a device and install malicious code or perform arbitrary administrative actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The issue is related to the Terminal Emulator application in the Dominion Voting Systems ImageCast X, which could be exploited by an attacker to gain elevated privileges on a device and/or install malicious code. The vulnerability is also associated with the presence of undocumented commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The issue is related to the incorrect validation of cryptographic signatures in the terminal emulator software of the ImageCast X ballot marking device. This could allow an attacker to execute arbitrary code. The problem arises because the tested version of the device does not validate application signatures to a trusted root certificate, which is crucial for ensuring that software installed on the device can be traced back to or verified against a cryptographic key provided by the manufacturer. This lack of validation could enable an attacker to install malicious code, potentially spreading it to other vulnerable ImageCast X devices via removable media. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dominion Voting Systems ImageCast X (affected versions not specified) **Description** The issue concerns the on-screen application hash display feature, audit log export, and application export functionality of Dominion Voting Systems ImageCast X, which rely on self-attestation mechanisms. This could allow an attacker to disguise malicious applications on a device, potentially leading to unauthorized access to protected information. The vulnerability is related to the modification of attestation data or measurement reports. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TitanHQ WebTitan Gateway (affected versions not specified) Description: The issue concerns incorrect certificate validation for the TLS interception feature. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.5 **Description** The issue is related to the lack of protection for internal data in the Tcl component of the operating system. It can be exploited by a remote attacker to obtain sensitive information by leveraging SSLv2 support. **Recommendations** For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider disabling SSLv2 support to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions prior to 0.9.8zf OpenSSL versions prior to 1.0.0r OpenSSL versions prior to 1.0.1m OpenSSL versions prior to 1.0.2a **Description** The issue allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle. This is related to an issue where the get client master key function in s2 srvr.c in the SSLv2 implementation accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher. **Recommendations** For versions prior to 0.9.8zf, update to version 0.9.8zf or later. For versions prior to 1.0.0r, update to version 1.0.0r or later. For versions prior to 1.0.1m, update to version 1.0.1m or later. For versions prior to 1.0.2a, update to version 1.0.2a or later.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions prior to 0.9.8zf OpenSSL versions 1.0.0 prior to 1.0.0r OpenSSL versions 1.0.1 prior to 1.0.1m OpenSSL versions 1.0.2 prior to 1.0.2a **Description** The issue is related to the get client master key function in the SSLv2 implementation, where an oracle protection mechanism incorrectly overwrites MASTER-KEY bytes during the use of export cipher suites. This makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle. **Recommendations** For OpenSSL versions prior to 0.9.8zf, update to version 0.9.8zf or later. For OpenSSL versions 1.0.0 prior to 1.0.0r, update to version 1.0.0r or later. For OpenSSL versions 1.0.1 prior to 1.0.1m, update to version 1.0.1m or later. For OpenSSL versions 1.0.2 prior to 1.0.2a, update to version 1.0.2a or later.

**Name of the Vulnerable Software and Affected Versions** Supermicro IPMI implementation versions (affected versions not specified) **Description** The issue affects the web interface in the Intelligent Platform Management Interface (IPMI) implementation, allowing remote authenticated users to execute arbitrary commands via shell metacharacters. This can be demonstrated by the IP address field in the `config date time.cgi` endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa OnCell Gateway versions prior to 1.4 **Description** The issue is related to insufficient entropy for SSH and SSL keys, making it easier for remote attackers to gain access by leveraging knowledge of a key from another product installation. **Recommendations** For versions prior to 1.4, update the firmware to version 1.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** AxWebRemoveCtrl ActiveX control (affected versions not specified) **Description** The issue allows remote attackers to download and execute arbitrary code. This is similar to a previously identified vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeSupport.ocx (affected versions not specified) **Description** The issue concerns the CodeSupport.ocx ActiveX control used by Sony, which has "safe for scripting" enabled. This allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.