About Time Herowatch Go system signing flaw allows privilege escalation and arbitrary code execution
Anyone logged into the device can seize top control.
Summary
Herowatch Mini signs its system with a publicly available test key, so a locally authenticated attacker can sign malicious programs, gain higher privileges and run arbitrary code. The product is no longer maintained, and all versions are affected.
Affected when
- Attacker with authenticated local access
What to do
No fixed version exists because the product is no longer maintained. Replace it with a supported device.
Update these devices now.
- About Time Technologies Herowatch Mini
Products and platforms
CVE IDs
Sources
- Write-up: twcert.org.tw (opens in a new tab) · twcert.org.tw (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen