Spencer Hsieh

**Name of the Vulnerable Software and Affected Versions** CarlinKit CPC200-CCPA (affected versions not specified) **Description** The issue is related to a Missing Root of Trust Local Privilege Escalation. It allows for local privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CarlinKit CPC200-CCPA (affected versions not specified) **Description** The issue is related to an improper verification of cryptographic signature, which can lead to code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CarlinKit CPC200-CCPA (affected versions not specified) **Description** The issue concerns an improper verification of cryptographic signature, potentially leading to code execution. This has been identified in the update.cgi component. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CarlinKit CPC200-CCPA Wireless Hotspot (affected versions not specified) **Description** The issue concerns a hard-coded credentials authentication bypass vulnerability in the CarlinKit CPC200-CCPA Wireless Hotspot. This allows for unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 70mai A510 (affected versions not specified) **Description** The issue concerns the use of a default password, allowing authentication bypass. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Volkswagen Customer-Link App version 1.30 HTC Customer-Link Bridge (affected versions not specified) **Description** This issue allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the Customer-Link App and Customer-Link Bridge, resulting from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this issue to inject CAN messages. **Recommendations** For Volkswagen Customer-Link App version 1.30, update the protection mechanism to prevent unauthorized firmware updates. For HTC Customer-Link Bridge, implement proper protection against unauthorized firmware updates to prevent CAN message injection. As a temporary workaround, consider restricting access to the firmware update mechanism in both the Customer-Link App and the Customer-Link Bridge until a proper fix is available.