CVE-2025-48468

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware...

CVE-2025-48468

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware...

microcode_ctl: From CVEorg collector

Incorrect behavior order for some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access...

CVE-2025-48468 Open JTAG Debug Port

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware...

CVE-2025-48468 Open JTAG Debug Port

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware...

CVE-2025-48468

CVE-2025-48468 centers on an open JTAG debug port that, with physical access, lets an attacker inject or modify firmware. Multiple connected sources tie this to Advantech industrial controllers (e.g., WISE-4010LAN, WISE-4050LAN, WISE-4060LAN) and describe the root cause as reliance on a JTAG inte...

Advantech多款产品 安全漏洞

The Advantech WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN are all industrial automation controllers from Advantech of Taiwan, China. A code execution vulnerability exists in multiple Advantech products, which can be exploited by attackers to inject or modify firmware via the JTAG interface...

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services WFBSS agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in...

PT-2025-26680 · Advantech +1 · Advantech Wireless Sensing/Equipment +6

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows an attacker with physical access to the JTAG interface to inject or modify firmware. This could be achieved through successful exploitation of the vulnerability, potentially...

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services WFBSS agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in...

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services WFBSS agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in...

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services WFBSS agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in...

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services WFBSS agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in...

CVE-2025-49487

Trend Micro Worry-Free Business Security Services (WFBSS) SaaS client is vulnerable to an uncontrolled search path/element that could allow an attacker with physical access to execute arbitrary code (in ZDI, as SYSTEM). The on-premise WFBSS is not affected. Root cause is tied to loading an OpenSS...

Astra Linux – Vulnerability in Intel Microcode

The incorrect behavior order of some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure through physical access...

CVE-2025-5484

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced duri...

CVE-2025-26412

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands...

CVE-2024-35295

A vulnerability has been identified in Perfect Harmony GH180 All versions = V8.0 V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025. The maintenance connection of affected devices fails to protect access to the device's control unit configuration. This could allow an...

CVE-2025-4227

An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows...

CVE-2025-5484

CVE-2025-5484 (SinoTrack GPS Receiver) affects SinoTrack devices with a central device management interface. The root cause is weak authentication: the username is the device identifier printed on the receiver and the default password is well-known and not enforced to be changed during setup. Thi...