Description
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| About Time Technologies | Herowatch Go | all | — |
References
- https://www.twcert.org.tw/en/cp-139-11362-1e829-2.html third-party-advisory
- https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html third-party-advisory