LITEON Security Bulletin: CLI Privilege Escalation & RPC Command Injection Fixes

LITEON Product Security Advisory - Vulnerability Key Information Summary Vulnerability Overview 2026/08/14 - Fixed a vulnerability in the CLI interface that allowed users to obtain root privileges - Fixed a command injection vulnerability in the M-plane RPC "Retrieve File List" function 2025/03/06 - Users are now required to change their password upon first login 2025/02/18 - Closed ports 1534 and 80 - Removed the ssh algorithms Diffie-Hellman-group1-sha1 and hmac-md5 - Supported password complexity (in bin/bash) - CLI supports detecting invalid firmware images - Restart and shutdown events are now logged in the security log - Fail-safe mechanism to prevent invalid firmware updates 2024/12/09 - Adjusted product name in the CLI - If there are 3 incorrect CLI password attempts, the system will lock for 1 minute - CLI user timeout - Added logout notifications - CLI supports password complexity mechanisms Scope of Impact Affects the CLI interface, M-plane RPC functions, SSH algorithms, port configurations, password policies, firmware update mechanisms, etc. of LITEON products. Remediation The vulnerabilities are fixed through the software updates provided by LITEON. Customers are advised to regularly visit the page to obtain the latest software updates and descriptions of fixed issues. How to Report a Vulnerability Email: sg-security@liteon.com Phone: 02-87982888-3470 Reports should include vulnerability details, potential impact, and possible attack methods. Vulnerability Reporting Standards Applicable: 1. Clear technical descriptions should be provided 2. Include test steps or a Proof of Concept (PoC) 3. Avoid public disclosure before the vendor releases a fix Not Applicable: 1. Low-risk issues (e.g., UI bugs) 2. Vulnerabilities requiring physical access 3. Issues originating from outdated or unsupported software versions

Goal Reached Thanks to every supporter — we hit 100%!

LITEON Security Bulletin: CLI Privilege Escalation & RPC Command Injection Fixes