Monthly
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version Number (SVN) with an older value, enabling a downgrade rollback to earlier firmware versions that lack current security protections. All releases prior to 2605_10.2616 are affected. By reverting the device to a prior vulnerable firmware state, an attacker can bypass protection mechanisms enforced in newer firmware - including security controls, hardening measures, or patched vulnerabilities - achieving full confidentiality, integrity, and availability compromise of the thin client.
CVE-2025-5825 is a firmware downgrade remote code execution vulnerability in Autel MaxiCharger AC Wallbox Commercial charging stations that allows network-adjacent attackers with Bluetooth pairing capability to execute arbitrary code by uploading a malicious firmware image without proper validation. The vulnerability has a CVSS score of 7.5 (High) with high confidentiality, integrity, and availability impact, though exploitation requires prior Bluetooth device pairing. This is a ZDI-coordinated disclosure (ZDI-CAN-26354) affecting commercial charging infrastructure.
Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. Rated low severity (CVSS 3.1), this vulnerability is low attack complexity. No vendor patch available.
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older,. Rated low severity (CVSS 1.8), this vulnerability is no authentication required. No vendor patch available.
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version Number (SVN) with an older value, enabling a downgrade rollback to earlier firmware versions that lack current security protections. All releases prior to 2605_10.2616 are affected. By reverting the device to a prior vulnerable firmware state, an attacker can bypass protection mechanisms enforced in newer firmware - including security controls, hardening measures, or patched vulnerabilities - achieving full confidentiality, integrity, and availability compromise of the thin client.
CVE-2025-5825 is a firmware downgrade remote code execution vulnerability in Autel MaxiCharger AC Wallbox Commercial charging stations that allows network-adjacent attackers with Bluetooth pairing capability to execute arbitrary code by uploading a malicious firmware image without proper validation. The vulnerability has a CVSS score of 7.5 (High) with high confidentiality, integrity, and availability impact, though exploitation requires prior Bluetooth device pairing. This is a ZDI-coordinated disclosure (ZDI-CAN-26354) affecting commercial charging infrastructure.
Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. Rated low severity (CVSS 3.1), this vulnerability is low attack complexity. No vendor patch available.
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older,. Rated low severity (CVSS 1.8), this vulnerability is no authentication required. No vendor patch available.