Monthly
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
Improper access control on the debug and engineering interfaces of Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 drive platforms lets attackers read and write internal device values and, more critically, upload and execute unsigned applications, EEPROM data, and firmware through exposed service and software-update mechanisms. Rated CVSS 4.0 9.3, the flaw effectively bypasses code-signing and grants full control over affected industrial drive controllers. There is no public exploit identified at time of analysis, but the missing authentication and firmware-overwrite capability make this a severe integrity and availability risk for operational technology environments.
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV.
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access.
Physical attackers who can obtain, disassemble and hardware-modify a TP-Link Kasa EC70 v4 or EC71 v4 smart plug can restore the manufacturing-severed debug traces, interrupt the boot process and manipulate boot parameters to reach a non-standard initialization path that spawns an unauthenticated root shell during startup, giving full root-level control over the device (high confidentiality, integrity and availability impact to the device itself). The root cause is improper access control on the on-chip debug interface (CWE-1191): the production debug interface is not logically disabled at the firmware or chip level and the bootloader is not locked, so the physical cut of the debug traces is the only barrier. The attacker path is purely physical (CVSS 4.0 AV:P/AC:L/AT:P, assessed as CVSS 3.1 AV:P/AC:H), with no remote or over-the-air vector, and exploitation demands disassembly, trace rework (resoldering/bridging) and boot-timing manipulation; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while vendor firmware updates are available per the TP-Link release notes.
Dell BOSS-N1 controllers running firmware prior to 2.2.13.2038 expose an unprotected on-chip debug and test interface on the SMCU, allowing anyone with physical access to bypass authentication and read or write protected controller memory, yielding high confidentiality, integrity, and availability impact (CVSS 6.8, AV:P/AC:L/PR:N/UI:N). The attack surface is strictly local: exploitation requires hands-on connection to the debug interface of the SMCU on a 17th-generation PowerEdge server, so remote or network attack is impossible and realistic exposure is limited to insiders, hardware in transit or during servicing, decommissioned or resold units, and evil-maid/supply-chain scenarios. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the physical-access prerequisite keeps practical priority low despite the Medium base score.
Unauthenticated physical attackers with access to a server's internals can exploit an improperly protected on-chip debug and test interface on the SMCU of Dell BOSS-N1 17G controllers (firmware prior to 2.2.13.2038) to gain unauthorized access, primarily threatening integrity. This is a low-priority, high-friction vulnerability requiring physical presence, high attack complexity, and user interaction, and no public exploit has been identified. Dell has released firmware version 2.2.13.2038 to address the issue.
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity.
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
Improper access control on the debug and engineering interfaces of Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 drive platforms lets attackers read and write internal device values and, more critically, upload and execute unsigned applications, EEPROM data, and firmware through exposed service and software-update mechanisms. Rated CVSS 4.0 9.3, the flaw effectively bypasses code-signing and grants full control over affected industrial drive controllers. There is no public exploit identified at time of analysis, but the missing authentication and firmware-overwrite capability make this a severe integrity and availability risk for operational technology environments.
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV.
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access.
Physical attackers who can obtain, disassemble and hardware-modify a TP-Link Kasa EC70 v4 or EC71 v4 smart plug can restore the manufacturing-severed debug traces, interrupt the boot process and manipulate boot parameters to reach a non-standard initialization path that spawns an unauthenticated root shell during startup, giving full root-level control over the device (high confidentiality, integrity and availability impact to the device itself). The root cause is improper access control on the on-chip debug interface (CWE-1191): the production debug interface is not logically disabled at the firmware or chip level and the bootloader is not locked, so the physical cut of the debug traces is the only barrier. The attacker path is purely physical (CVSS 4.0 AV:P/AC:L/AT:P, assessed as CVSS 3.1 AV:P/AC:H), with no remote or over-the-air vector, and exploitation demands disassembly, trace rework (resoldering/bridging) and boot-timing manipulation; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while vendor firmware updates are available per the TP-Link release notes.
Dell BOSS-N1 controllers running firmware prior to 2.2.13.2038 expose an unprotected on-chip debug and test interface on the SMCU, allowing anyone with physical access to bypass authentication and read or write protected controller memory, yielding high confidentiality, integrity, and availability impact (CVSS 6.8, AV:P/AC:L/PR:N/UI:N). The attack surface is strictly local: exploitation requires hands-on connection to the debug interface of the SMCU on a 17th-generation PowerEdge server, so remote or network attack is impossible and realistic exposure is limited to insiders, hardware in transit or during servicing, decommissioned or resold units, and evil-maid/supply-chain scenarios. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the physical-access prerequisite keeps practical priority low despite the Medium base score.
Unauthenticated physical attackers with access to a server's internals can exploit an improperly protected on-chip debug and test interface on the SMCU of Dell BOSS-N1 17G controllers (firmware prior to 2.2.13.2038) to gain unauthorized access, primarily threatening integrity. This is a low-priority, high-friction vulnerability requiring physical presence, high attack complexity, and user interaction, and no public exploit has been identified. Dell has released firmware version 2.2.13.2038 to address the issue.
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity.