Monthly
Physical access to a Mercusys AC12 V2 router's printed circuit board lets an attacker take full control of the device: the UART debug header on the board is exposed with no authentication gate or lockdown, so wiring a serial adapter to the correct pins yields an interactive, root-level console from which arbitrary code can be executed (CWE-1299, unprotected alternate hardware interface). The CVSS 3.1 base score of 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability, tempered only by the requirement for hands-on hardware access - there is no network, Wi-Fi, or LAN attack path, so remote exploitation is not possible. No confirmed active exploitation and no public exploit code have been reported, and the EPSS score is 0.16% (4th percentile), consistent with a flaw whose realistic exposure is limited to supply-chain, device-resale, lost/stolen, or evil-maid scenarios.
Privilege escalation in Intel QuickAssist Technology (QAT) on certain Intel platforms allows a system-software adversary already holding privileged (Ring 0 / kernel-level) access to read and corrupt kernel state via an unprotected alternate hardware interface. The flaw stems from a missing protection mechanism on a secondary hardware control path, yielding high confidentiality and integrity impact but no availability loss. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not listed in CISA KEV.
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device. Rated high severity (CVSS 7.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Physical access to a Mercusys AC12 V2 router's printed circuit board lets an attacker take full control of the device: the UART debug header on the board is exposed with no authentication gate or lockdown, so wiring a serial adapter to the correct pins yields an interactive, root-level console from which arbitrary code can be executed (CWE-1299, unprotected alternate hardware interface). The CVSS 3.1 base score of 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability, tempered only by the requirement for hands-on hardware access - there is no network, Wi-Fi, or LAN attack path, so remote exploitation is not possible. No confirmed active exploitation and no public exploit code have been reported, and the EPSS score is 0.16% (4th percentile), consistent with a flaw whose realistic exposure is limited to supply-chain, device-resale, lost/stolen, or evil-maid scenarios.
Privilege escalation in Intel QuickAssist Technology (QAT) on certain Intel platforms allows a system-software adversary already holding privileged (Ring 0 / kernel-level) access to read and corrupt kernel state via an unprotected alternate hardware interface. The flaw stems from a missing protection mechanism on a secondary hardware control path, yielding high confidentiality and integrity impact but no availability loss. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not listed in CISA KEV.
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device. Rated high severity (CVSS 7.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.