Monthly
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Physical exploitation of an insecure debug feature in CP PLUS EZ-P21 IP Camera firmware allows attackers to execute arbitrary code with elevated privileges. Firmware versions v4.8.8.1 and earlier are affected. Exploitation requires physical access to insert removable media containing a malicious payload, but no authentication or user interaction is needed.
Root-level device takeover affects the Allwinner H616-based TV98 Android TV Box, which ships to production with the Android Debug Bridge (ADB) daemon enabled and reachable over the network (TCP/5555). A network attacker can send an ADB authorization request, and if the victim accepts the RSA key confirmation prompt on the device, the attacker obtains a root shell. Classified under CWE-489 (leftover debug functionality), there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the attack is trivial once a user approves the pairing.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure and denial of service in JuiceFS through 1.3.1 lets remote attackers reach Go pprof debug and Prometheus metrics endpoints that are inadvertently exposed because handlers are registered on the shared http.DefaultServeMux. By fetching /debug/pprof/cmdline an attacker recovers the process command line, which embeds the metadata engine connection string and its database credentials, effectively yielding full read/write control over filesystem metadata; other pprof and profiling handlers leak internal state and can be abused to exhaust resources. Reported by VulnCheck with an upstream fix in commit a46979c; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated root command execution affects the Acer Connect M6E 5G Portable WiFi Router through firmware M6E_AI_1.00.000019, where the ai_cmd utility runs with root privileges and passes socket input directly to popen(). Adjacent-network attackers (anyone on the WiFi or LAN segment) can issue arbitrary shell commands as root with no authentication. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact on the device itself.
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Physical exploitation of an insecure debug feature in CP PLUS EZ-P21 IP Camera firmware allows attackers to execute arbitrary code with elevated privileges. Firmware versions v4.8.8.1 and earlier are affected. Exploitation requires physical access to insert removable media containing a malicious payload, but no authentication or user interaction is needed.
Root-level device takeover affects the Allwinner H616-based TV98 Android TV Box, which ships to production with the Android Debug Bridge (ADB) daemon enabled and reachable over the network (TCP/5555). A network attacker can send an ADB authorization request, and if the victim accepts the RSA key confirmation prompt on the device, the attacker obtains a root shell. Classified under CWE-489 (leftover debug functionality), there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the attack is trivial once a user approves the pairing.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure and denial of service in JuiceFS through 1.3.1 lets remote attackers reach Go pprof debug and Prometheus metrics endpoints that are inadvertently exposed because handlers are registered on the shared http.DefaultServeMux. By fetching /debug/pprof/cmdline an attacker recovers the process command line, which embeds the metadata engine connection string and its database credentials, effectively yielding full read/write control over filesystem metadata; other pprof and profiling handlers leak internal state and can be abused to exhaust resources. Reported by VulnCheck with an upstream fix in commit a46979c; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated root command execution affects the Acer Connect M6E 5G Portable WiFi Router through firmware M6E_AI_1.00.000019, where the ai_cmd utility runs with root privileges and passes socket input directly to popen(). Adjacent-network attackers (anyone on the WiFi or LAN segment) can issue arbitrary shell commands as root with no authentication. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact on the device itself.