The public-facing product registration endpoint server responds
differently depending on whether the S/N is valid and unregistered,
valid but already registered, or does not exist in the database.
Combined with the fact that serial numbers are sequentially assigned,
this allows an attacker to gain information on the product registration
status of different S/Ns.
The public-facing product registration endpoint server responds
differently depending on whether the S/N is valid and unregistered,
valid but already registered, or does not exist in the database.
Combined with the fact that serial numbers are sequentially assigned,
this allows an attacker to gain information on the product registration
status of different S/Ns.
EG4 has acknowledged the vulnerabilities and is actively working on a
fix, including new hardware expected to release by October 15, 2025.
Until then, EG4 will actively monitor all installed systems and work
with affected users on a case-by-case basis if anomalies are observed.
For more information, contact EG4. https://eg4electronics.com/contact/
Exploits
Credits
finder
Anthony Rose of BC Security reported these vulnerabilities to CISA.
The public-facing product registration endpoint server responds
differently depending on whether the S/N is valid and unregistered,
valid but already registered, or does not exist in the database.
Combined with the fact that serial numbers are sequentially assigned,
this allows an attacker to gain information on the product registration
status of different S/Ns.