IDM's kernel driver hands out SYSTEM, Orion Visor's hardcoded key leaks every credential

An attacker can inject SQL remotely through the Legacy API in Feng Office by manipulating the 'auth' parameter in the CompanyWebsite contacts lookup. This could let them read or modify your entire Feng Office database without authentication. A public exploit is available, and the vendor has not responded.

Affected estate

Teams running self-hosted Feng Office version 3.11.13.11 or earlier

How to check

Check your Feng Office version in the admin panel or in the source files. Confirm whether the Legacy API is exposed by reviewing your web server config for the relevant route.

Included because

unauthenticated; remote; SQL injection; public exploit available; vendor unresponsive

Action

Upgrade Feng Office if a fix is available. Otherwise, block or restrict access to the Legacy API at your reverse proxy or firewall.

Why it matters

Remote, unauthenticated SQL injection with a public exploit means your database is one HTTP request away from compromise.

The IEC 60870-5-104 TLS client in the Kalkitech ASE2000 V2 Communication Test Set doesn't properly validate certificates. A network-positioned attacker can present a malformed certificate and intercept supposedly encrypted SCADA/ICS traffic via a Man-in-the-Middle attack. This only affects versions 2.35 through 2.37 and specifically the Task Mode TLS client.

Affected estate

ICS/SCADA engineers and utility operators using the Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 on Windows

How to check

Check the firmware version in the ASE2000 device interface or configuration utility.

Included because

ICS/SCADA equipment; TLS bypass; network-positioned MitM; CVSS 7.4

Action

Apply a firmware update from Kalkitech if one exists. Segment the device onto a trusted, isolated network to reduce MitM risk.

Why it matters

Broken TLS validation on an ICS test tool means an attacker on the network can silently intercept or tamper with SCADA protocol traffic.

Orion Visor (by dromara) uses a hard-coded cryptographic key to encrypt host keys. Any attacker who reads the source code, which is publicly available, knows the key and can decrypt every stored host credential. This is remotely exploitable and a public exploit exists.

Affected estate

Anyone running self-hosted dromara Orion Visor version 2.5.7 or earlier for remote host management

How to check

Check your deployed Orion Visor version. Review the HostKeyServiceImpl class to confirm whether the hard-coded key is present in your build.

Included because

remote; hard-coded crypto key; credential exposure; public exploit; CVSS 8.3

Action

Upgrade Orion Visor to a version with a unique, configurable encryption key. After upgrading, rotate all stored host keys and credentials immediately.

Why it matters

A hard-coded key in an open-source project means every stored credential is effectively in plaintext to anyone who looks at the repo.

The password recovery function in Tourism-Management-System generates weak or predictable reset tokens. A remote attacker can exploit this to take over arbitrary user accounts without knowing the original password. A public exploit exists and a patch commit is available.

Affected estate

Developers or operators running the jaychouchannel Tourism-Management-System project

How to check

Check your deployed commit hash against the fix commit (9cb6215ac871f99a90cde763cf003e95ff282283). If your build is older, you're affected.

Included because

remote; account takeover via weak recovery; public exploit; CVSS 7.3

Action

Pull and deploy the patched commit. Invalidate all outstanding reset tokens and force password resets for accounts that recently used account recovery.

Why it matters

Weak password recovery lets a remote attacker hijack any user account, which could expose customer data and admin access.