Tobias Scharnowski

Name of the Vulnerable Software and Affected Versions: Affected versions not specified Description: An unauthenticated remote attacker can alter the device configuration to achieve remote code execution as root with specific configurations. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Autel MaxiCharger AC Wallbox Commercial autocharge (affected versions not specified) **Description** The issue is a stack-based buffer overflow that allows for remote code execution. It was discovered by Tobias Scharnowski, Felix Buchmann, and Kristian Covic. The vulnerability was demonstrated at Pwn2Own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WOLFBOX Level 2 EV Charger (affected versions not specified) **Description** This issue allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. The flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications, resulting from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this to bypass authentication on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Trusted Firmware-M versions through 2.1.0 Description: An issue was discovered where user-provided mailbox messages contain a pointer to a list of input arguments (`in vec`) and output arguments (`out vec`) that are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated, allowing an attacker to write anywhere in the secure firmware. This can be used to take over the control flow, leading to remote code execution (RCE). Recommendations: For versions through 2.1.0, update to the latest release to mitigate risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ChargePoint Home Flex (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `wlanchnllst` function, resulting from the lack of proper validation of user-supplied data, which can cause a write past the end of an allocated buffer. An attacker can leverage this to execute code in the context of root. **Recommendations** As a temporary workaround, consider disabling the `wlanchnllst` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** ChargePoint Home Flex (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `SrvrToSmSetAutoChnlListMsg` function, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX5500 (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this issue. The specific flaw exists within the handling of software updates, resulting from the lack of proper validation of software update packages. An attacker can leverage this issue to execute code in the context of the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX5500 (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this issue. The specific flaw exists within the USB host driver. A crafted USB configuration descriptor can trigger an overflow of a fixed-length buffer. An attacker can leverage this issue to execute code in the context of the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Phoenix Contact CHARX SEC-3100 (affected versions not specified) **Description** An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bluetooth HCI (affected versions not specified) **Description** The issue is related to inconsistent handling of error cases in Bluetooth HCI, which may lead to a double free condition of a network buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02) ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior ICONICS GenBroker32 version 9.5 and prior Description: A deserialization vulnerability exists, allowing remote code execution and a denial-of-service condition due to a specially crafted communication packet sent to the affected devices. This issue is related to the restoration of an untrusted data structure in memory, which can be exploited by a remote attacker to execute arbitrary code or cause a denial-of-service. Recommendations: For Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, update to a version later than 4.02C (10.95.208.31) to resolve the issue. For Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02), update to a version later than 3.00A (9.50.255.02) to resolve the issue. For ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior, update to a version later than 10.96 to resolve the issue. For ICONICS GenBroker32 version 9.5 and prior, update to a version later than 9.5 to resolve the issue. As a temporary workaround, consider restricting access to the deserialization functionality until a patch is available.

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02) ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior ICONICS GenBroker32 version 9.5 and prior Description: A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. The issue is related to deficiencies in the deserialization mechanism, which can be exploited by a remote attacker to cause a denial-of-service condition. Recommendations: For Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, update to a version that fixes the deserialization issue. For Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02), update to a version that fixes the deserialization issue. For ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior, update to a version that fixes the deserialization issue. For ICONICS GenBroker32 version 9.5 and prior, update to a version that fixes the deserialization issue. As a temporary workaround, consider restricting access to the deserialization mechanism until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions 4.3 and earlier Contiki versions 3.0 and earlier **Description** A buffer overflow issue is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory, crashing the application. An attacker can cause a denial-of-service via a crafted 6LoWPAN frame. **Recommendations** For Contiki-NG versions 4.3 and earlier, update to a version later than 4.3 to resolve the issue. For Contiki versions 3.0 and earlier, update to a version later than 3.0 to resolve the issue. As a temporary workaround, consider restricting the processing of 6LoWPAN fragments to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG versions 4.3 and earlier Contiki versions 3.0 and earlier **Description** An issue is present in the data section during 6LoWPAN fragment re-assembly due to forged fragment offsets in os/net/ipv6/sicslowpan.c, resulting in an out of bounds write. **Recommendations** For Contiki-NG versions 4.3 and earlier, consider updating to a version that addresses the out of bounds write issue in os/net/ipv6/sicslowpan.c. For Contiki versions 3.0 and earlier, consider updating to a version that addresses the out of bounds write issue in os/net/ipv6/sicslowpan.c. As a temporary workaround, consider restricting the use of the `sicslowpan.c` module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Triangle MicroWorks SCADA Data Gateway versions 2.41.0213 through 4.0.122 Triangle MicroWorks SCADA Data Gateway versions 3.02.0697 through 4.0.122 **Description** The issue allows remote attackers to disclose sensitive information due to the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. Authentication is not required to exploit this issue. This is only applicable to installations using DNP3 Data Sets. **Recommendations** For versions 2.41.0213 through 4.0.122, consider restricting access to the DNP3 Data Sets until a patch is available. For versions 3.02.0697 through 4.0.122, consider implementing additional validation for user-supplied data to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Triangle MicroWorks SCADA Data Gateway versions 2.41.0213 through 4.0.122 Triangle MicroWorks SCADA Data Gateway versions 3.02.0697 through 4.0.122 **Description** The issue allows remote attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, resulting in a type confusion condition. Authentication is not required to exploit this issue. This is only applicable to installations using DNP3 Data Sets. **Recommendations** For versions 2.41.0213 through 4.0.122, consider restricting access to the DNP3 Data Sets until a patch is available. For versions 3.02.0697 through 4.0.122, consider implementing additional validation for user-supplied data to prevent type confusion conditions. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Green Hills INTEGRITY RTOS version 5.0.4 **Description** An issue was discovered in the Interpeak IPCOMShell TELNET server. The undocumented shell command "prompt" sets the shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addresses. **Recommendations** For Green Hills INTEGRITY RTOS version 5.0.4, consider disabling the use of the `prompt` command in the Interpeak IPCOMShell TELNET server as a temporary workaround until a patch is available. Restrict access to the TELNET server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Green Hills INTEGRITY RTOS version 5.0.4 **Description** An issue in the Interpeak IPCOMShell TELNET server allows an attacker to forge a path containing format string modifiers when using the pwd command. This results in an information leak of memory addresses due to the lack of proper checks on the current working directory path used as an argument to printf(). **Recommendations** For Green Hills INTEGRITY RTOS version 5.0.4, consider restricting access to the pwd command in the Interpeak IPCOMShell TELNET server until a proper fix is applied to prevent the evaluation of custom format strings. As a temporary workaround, avoid using the pwd command with untrusted input to minimize the risk of information leakage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Green Hills INTEGRITY RTOS version 5.0.4 **Description** An issue was discovered in the Interpeak IPCOMShell TELNET server. The main shell handler function uses the value of the environment variable `ipcom.shell.greeting` as the first argument to `printf()`, resulting in a user-controlled format string during login. This leads to an information leak of memory addresses. **Recommendations** For Green Hills INTEGRITY RTOS version 5.0.4, consider restricting the ability to set the `ipcom.shell.greeting` environment variable using the sysvar command to minimize the risk of exploitation. As a temporary workaround, avoid using the `printf()` function with user-controlled input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Interpeak IPWEBS on Green Hills INTEGRITY RTOS version 5.0.4 **Description** The issue is related to the allocation of 60 bytes for the HTTP Authentication header in Interpeak IPWEBS on Green Hills INTEGRITY RTOS. When copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow. **Recommendations** For Interpeak IPWEBS on Green Hills INTEGRITY RTOS version 5.0.4, consider implementing size checks when copying the HTTP Authentication header to prevent buffer overflows. At the moment, there is no information about a newer version that contains a fix for this vulnerability.