SAU7000 Controller Firmware Update RCE Vulnerability (CVSS 9.8)

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Remote code execution vulnerability in the firmware update mechanism of the SAU7000 series controllers Vulnerability Type: Remote Code Execution (RCE) Affected Component: Firmware update mechanism of the SAU7000 series controllers Vulnerability Description: A vulnerability exists in the firmware update mechanism of the SAU7000 series controllers, allowing an attacker to trigger remote code execution through a specially crafted firmware update package CVSS Score: 9.8 (Critical) CWE: CWE-787 (race condition caused by non-atomic operations) Scope of Impact Affected Products: - SAU7000 series controllers (SAU7000, SAU7001, SAU7002, SAU7003, SAU7004, SAU7005, SAU7006, SAU7007, SAU7008) - Firmware versions: 7.0.0 and later Impact: Attackers can exploit this vulnerability to execute arbitrary code on the controllers, potentially leading to full device compromise, affecting device operation, reliability, and security Affected Product Groups: - Product Group 1: SAU7000, SAU7001, SAU7002, SAU7003, SAU7004, SAU7005, SAU7006, SAU7007, SAU7008 - Product Group 2: SAU7000, SAU7001, SAU7002, SAU7003, SAU7004, SAU7005, SAU7006, SAU7007, SAU7008 Remediation Vendor Fix: - Upgrade the affected SAU7000 series products to firmware version 7.0.0 or higher, and enable downgrade protection - Upgrade the affected SAU7000 series products to firmware version 7.0.0 or higher, and enable downgrade protection Mitigation Measures: - Protect access to the devices and network according to best practices and the current state of the art - Enable downgrade protection to prevent rollback to vulnerable older versions POC/Exploitation Code No POC code or exploitation code is included in the screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

SAU7000 Controller Firmware Update RCE Vulnerability (CVSS 9.8)