Monthly
Physical attackers with hands-on access to a Deck Mate 2 card shuffler can bypass boot verification entirely and persistently rewrite the bootloader, kernel, or filesystem, gaining code execution that survives reboots and power cycles. The device lacks both a verified secure-boot chain and runtime integrity validation for its controller and display modules, so tampered firmware is never cryptographically detected; no authentication or user interaction is needed once the attacker has access to the physical update/programming port. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is low at 0.22% (11th percentile), consistent with a flaw that requires device disassembly - this is a physical-access root-of-trust weakness rather than a remotely reachable network bug.
CVE-2025-5834 is a local privilege escalation vulnerability in Pioneer DMH-WT7600NEX infotainment systems caused by a missing hardware root of trust in the SoC configuration. An attacker with local access and valid authentication credentials can bypass the existing authentication mechanism and execute arbitrary code during boot with elevated privileges. The vulnerability has a CVSS score of 7.8 (High) and was previously tracked as ZDI-CAN-26078; exploitation likelihood and active exploitation status depend on public POC availability and EPSS scoring.
A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0) (All versions), IEC 1Ph 7.4kW Parent. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required. No vendor patch available.
CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Physical attackers with hands-on access to a Deck Mate 2 card shuffler can bypass boot verification entirely and persistently rewrite the bootloader, kernel, or filesystem, gaining code execution that survives reboots and power cycles. The device lacks both a verified secure-boot chain and runtime integrity validation for its controller and display modules, so tampered firmware is never cryptographically detected; no authentication or user interaction is needed once the attacker has access to the physical update/programming port. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is low at 0.22% (11th percentile), consistent with a flaw that requires device disassembly - this is a physical-access root-of-trust weakness rather than a remotely reachable network bug.
CVE-2025-5834 is a local privilege escalation vulnerability in Pioneer DMH-WT7600NEX infotainment systems caused by a missing hardware root of trust in the SoC configuration. An attacker with local access and valid authentication credentials can bypass the existing authentication mechanism and execute arbitrary code during boot with elevated privileges. The vulnerability has a CVSS score of 7.8 (High) and was previously tracked as ZDI-CAN-26078; exploitation likelihood and active exploitation status depend on public POC availability and EPSS scoring.
A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0) (All versions), IEC 1Ph 7.4kW Parent. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required. No vendor patch available.
CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.