Authorization

Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen...

CVE-2022-46752

Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service...

PT-2023-15013 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service...

Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs

Security researchers have disclosed two new vulnerabilities affecting Schneider Electric Modicon programmable logic controllers PLCs that could allow for authentication bypass and remote code execution. The flaws, tracked as CVE-2022-45788 CVSS score: 7.5 and CVE-2022-45789 CVSS score: 8.1, are...

Input validation

Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder...

PT-2023-11608

Name of the Vulnerable Software and Affected Versions OKER G955V1 version 1.03.02.20161128 Description The issue allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges. This is due to an OS Command Injection vulnerability. Recommendations For...

CVE-2020-22007

OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges...

CVE-2022-39900: Improper Access Control

Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch...

PT-2022-25104 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.0.06.7 Description: The issue is related to improper access control in Samsung Pass, allowing physical attackers to access data on an unlocked device in a specific state using a pop-up view. Recommendations: F...

Hardcoded credentials

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it...

CVE-2022-39873: Improper Authorization

Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...

CVE-2022-36851

Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of an unlocked device...

CVE-2022-36876

Samsung Pass contains a vulnerability in UPI payments (CVE-2022-36876). Prior to version 4.0.04.10, improper authorization allows physical attackers to access the account list without authentication. The PT-2022-23680 entry confirms affected versions and recommends upgrading to 4.0.04.10 or later...

CVE-2022-36851: Improper Access Control

Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of an unlocked device...

HP Desktop PC 安全漏洞

HP Desktop PC is a desktop computer from Hewlett-Packard HP in the United States. HP Desktop PC has a security vulnerability that originated from allowing intrusion detection to be bypassed via a physical attack...

HP Desktop PC 安全漏洞

HP Desktop PC is a desktop computer from Hewlett-Packard HP in the United States. HP Desktop PC has a security vulnerability that originated from allowing intrusion detection to be bypassed via a physical attack...

Seagate STDT4000100 安全漏洞

The Seagate STDT4000100 is a mechanical hard drive from Seagate USA. A security vulnerability exists in the Seagate STDT4000100 hard drive that originates from a physical attacker being able to exploit the audio signal of the Rhythm Nation music video to perform a resonant frequency attack, which...

CVE-2022-33730: Out-of-bounds Write

Heap-based buffer overflow vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows arbitrary code execution by physical attackers...

CVE-2022-30730: Improper Authorization

Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication...

CVE-2022-23822

In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader FSBL by bypassing authentication and loading a malicious image onto the device. This in turn may further allow the attacker to perform additional attacks such as such as using the device as a...