AutoAgent's unauthenticated root shell and a SonicWall NSM command injection top a rough Saturday

The Actualizer installer (v1.2.0 and earlier) doesn't check whether mkpasswd actually succeeded when hashing the root and alpha user passwords. If mkpasswd fails, the password field ends up empty, and the resulting image may allow passwordless login to root. This only triggers when the build environment lacks yescrypt support or uses an incompatible mkpasswd, so it won't hit every build, but if it does, your image ships wide open.

Affected estate

Anyone building Debian-based images with Holloway Chew's Actualizer v1.2.0 or earlier

How to check

Check the Actualizer version in your project dependencies. Inspect /etc/shadow in any generated images for empty password fields on root and alpha accounts.

Included because

fail-open auth bypass; CVSS 7.9; affects build outputs that may be deployed to production

Action

Upgrade Actualizer to the fixed release and rebuild affected images.

Why it matters

An image shipped with empty root credentials can be logged into without a password, giving an attacker full control.

Acunetix 25.11 on Windows has a local privilege escalation bug. The scanning engine (wvsc.exe) runs as SYSTEM and looks for an OpenSSL-related file in a directory that doesn't exist by default. A low-privilege local user can create that directory, drop a malicious file there, and wvsc.exe will load it as SYSTEM. That's full local privilege escalation on any box running this version.

Affected estate

Teams running Acunetix 25.11.251107123 on Windows

How to check

Check the installed Acunetix version via Programs and Features or the Acunetix web console's About page.

Included because

local privilege escalation to SYSTEM; CVSS 7.8; common security tooling often runs on shared infrastructure

Action

Upgrade Acunetix past 25.11.251107123.

Why it matters

Any local user on the scanning box can escalate to SYSTEM, fully compromising the host.

PassMark's DirectIo64.sys kernel driver, shipped with PerformanceTest, BurnInTest, and OSForensics, creates a device object with no security descriptor. That means any local user, regardless of privilege level, can open a handle and send IOCTLs to perform raw hardware operations. An attacker with any local access can use this to read/write physical memory or interact with hardware directly, which is a straight path to kernel-level compromise.

Affected estate

Anyone with PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), or OSForensics (before 11.1 build 1016) installed on Windows

How to check

Check installed versions via Programs and Features. Confirm whether DirectIo64.sys is loaded by running 'sc query DirectIo64' or checking Driver Store.

Included because

local privilege escalation; kernel driver with no ACL; CVSS 7.8; commonly found on IT workstations and forensic machines

Action

Update each PassMark product to the fixed build version, or unload/remove the DirectIo64.sys driver if the software isn't actively needed.

Why it matters

An unprivileged local user can issue privileged hardware IOCTLs through the unprotected driver, enabling kernel-level compromise.

AutoAgent runs a TCP server that binds to all interfaces, requires no authentication, and executes whatever commands you send it as root. An attacker who can reach the port gets a root shell inside the container, plus access to any host directories bind-mounted into it. No credentials needed, no user interaction, just connect and run commands.

Affected estate

Anyone running AutoAgent with its TCP server exposed, whether in containers or directly on a host

How to check

Run 'netstat -tlnp' or 'ss -tlnp' on the host to find listening ports associated with AutoAgent. Check Docker or container orchestration configs for bind-mounted host paths.

Included because

unauthenticated; remote code execution as root; internet-facing by default; CVSS 9.8; no exploit complexity

Action

Immediately block network access to the AutoAgent TCP port via firewall rules or shut down the service. Patch when a fix is released.

Why it matters

Unauthenticated remote root command execution with potential access to host filesystems is about as bad as it gets.