J. Kruchem

**Name of the Vulnerable Software and Affected Versions** Quanos SCHEMA ST4 on-premises (affected versions not specified) **Description** The Client Update Service contains a local privilege escalation issue caused by insecure deserialization within the .NET Remoting service. The service uses `TypeFilterLevel.Full` and is bound to local interfaces via named pipes. A local authenticated attacker can connect to the named pipe, access the .NET Remoting endpoint, and transmit specially crafted serialized objects. This allows for arbitrary code execution with NT AUTHORITYSYSTEM privileges. This issue requires a local authenticated user session and cannot be exploited over a network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITYSYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation.

**Name of the Vulnerable Software and Affected Versions** Digital Guardian Agent versions prior to 7.9.4 **Description** The issue is related to the unprotected storage of sensitive information in the Digital Guardian Agent. This allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file. **Recommendations** For versions prior to 7.9.4, update to version 7.9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the uninstaller file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Miele Benchmark Programming Tool versions prior to 1.2.71 **Description** The issue allows executable files manipulated by attackers to be unknowingly executed with user privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binaries as admin, potentially obtaining higher permissions. The attacker must already have access to the corresponding local system to exchange the files. **Recommendations** For versions prior to 1.2.71, update to version 1.2.71 or later to resolve the issue. As a temporary workaround, consider restricting access to executable files and limiting user privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Rittal PDU-3C002DEC versions through 5.17.10 Rittal CMCIII-PU-9333E0FB versions through 3.17.10 **Description** An issue was discovered on Rittal devices, where there is a backdoor root account. **Recommendations** For Rittal PDU-3C002DEC versions through 5.17.10, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Rittal CMCIII-PU-9333E0FB versions through 3.17.10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rittal PDU devices versions 3C002DEC through 5.17.10 Rittal CMCIII-PU devices versions 9333E0FB through 3.17.10 **Description** An issue was discovered that involves a least privilege violation. **Recommendations** For Rittal PDU devices versions 3C002DEC through 5.17.10, update to a version that addresses the least privilege violation issue. For Rittal CMCIII-PU devices versions 9333E0FB through 3.17.10, update to a version that addresses the least privilege violation issue.

**Name of the Vulnerable Software and Affected Versions** Rittal PDU-3C002DEC versions through 5.17.10 Rittal CMCIII-PU-9333E0FB versions through 3.17.10 **Description** An issue was discovered that allows attackers to bypass the CLI menu. **Recommendations** For Rittal PDU-3C002DEC versions through 5.17.10, update to a version that addresses the CLI menu bypass issue. For Rittal CMCIII-PU-9333E0FB versions through 3.17.10, update to a version that addresses the CLI menu bypass issue.

**Name of the Vulnerable Software and Affected Versions** Rittal PDU-3C002DEC versions 5.15.40 and earlier Rittal CMCIII-PU-9333E0FB versions 3.15.70 4 and earlier **Description** An issue was discovered that allows attackers to execute code. **Recommendations** For Rittal PDU-3C002DEC versions 5.15.40 and earlier, update to a version later than 5.15.40. For Rittal CMCIII-PU-9333E0FB versions 3.15.70 4 and earlier, update to a version later than 3.15.70 4.

**Name of the Vulnerable Software and Affected Versions** Rittal PDU devices versions 3C002DEC through 5.15.70 Rittal CMCIII-PU devices versions 9333E0FB through 3.15.70 **Description** An issue was discovered related to insecure permissions on the affected devices. **Recommendations** For Rittal PDU devices versions 3C002DEC through 5.15.70, update the device to a version with secure permissions. For Rittal CMCIII-PU devices versions 9333E0FB through 3.15.70, update the device to a version with secure permissions.