Overview
A newly identified vulnerability in some UEFI-supported motherboard models leaves systems vulnerable to early-boot DMA attacks across architectures that implement UEFI and IOMMU. Although the firmware indicates that DMA protection is active, it fails to correctly initialize the IOMMU. Therefore, a malicious PCIe device with physical access can read or modify system memory before the operating system’s defenses load. This exposes sensitive data and enables pre-boot code injection on affected systems running unpatched firmware.
Description
Modern systems rely on UEFI firmware and the Input–Output Memory Management Unit (IOMMU) to establish a secure foundation before the operating system loads. UEFI initializes hardware and enforces early security policies while the IOMMU restricts peripheral devices from performing unauthorized memory accesses. Together, these components help ensure that direct memory access (DMA)-capable devices cannot tamper with or inspect system memory during the critical pre-boot phase.
A vulnerability discovered in certain UEFI implementations arises from a discrepancy between reported and actual DMA protection. Even though firmware asserts that DMA protections are active, it fails to properly configure and enable the IOMMU during the early hand-off phase in the boot sequence. This gap allows a malicious DMA-capable Peripheral Component Interconnect Express (PCIe) device with physical access to read or modify system memory before operating system-level safeguards are established. As a result, attackers could potentially access sensitive data in memory or influence the initial state of the system, thus undermining the integrity of the boot process.
Vendors whose products are affected have begun releasing firmware updates to correct the IOMMU initialization sequence and properly enforce DMA protections throughout boot. Users and administrators should apply these updates as soon as they become available to ensure their systems are not exposed to this class of pre-boot DMA attacks. In environments where physical access cannot be fully controlled or relied on, prompt patching and adherence to hardware security best practices are especially important. Because the IOMMU also plays a foundational role in isolation and trust delegation in virtualized and cloud environments, this flaw highlights the importance of ensuring correct firmware configuration even on systems not typically used in data centers.
Impact
Improper IOMMU initialization in UEFI firmware on some UEFI-based motherboards from multiple vendors allows a physically present attacker using a DMA-capable PCIe device to bypass early-boot memory protection. The attacker could access or alter system memory via DMA transactions processed before the operating system enables its security controls.
Solution
Users and administrators should apply the latest firmware updates as soon as they become available as these patches correct the IOMMU initialization issue and restore proper DMA protections during early boot. Because multiple vendors are affected and updates are being released on varying timelines, customers should regularly monitor the Vendor Information section for newly published advisories and updated firmware packages. Environments where physical access is difficult to control should prioritize patching promptly to reduce exposure to pre-boot DMA attacks.
Acknowledgements
Thanks to reporter Nick Peterson and Mohamed Al-Sharifi of Riot Games for identifying this issue and working with vendor teams and the Taiwanese CERT to coordinate the response and reach affected product vendors. This document was written by Vijay Sarvepalli.

Overview
Vulnerabilities have been identified in Siemens Gridscale X Prepay that allows unauthenticated username enumeration and enables an attacker to bypass account lock functionality. These issues may permit unauthorized access or prolonged access to protected resources, even after an account has been administratively locked.
Description
Siemens Gridscale X Prepay is a scalable energy management solution for utilities, integrating smart meters and customer payment options. The related vulnerabilities increase the risk of unauthorized actions, data exposure, or misuse of sensitive organizational resources.
CVE-2025-40806 Unauthenticated username enumeration. An attacker may determine the validity of usernames by a response code, allowing the attacker to determine whether a username is valid before authentication occurs. This exposure can facilitate targeted attacks by allowing an adversary to identify valid accounts before attempting further compromise.
CVE-2025-40807 Account lock bypass. An attacker can bypass the intended account lock protection by replaying or modifying previously captured valid responses. The issue appears related to session tokens that remain valid after logout or after an administrative account lock. Because these tokens do not expire immediately, an attacker with access to previously captured network responses can continue access the system despite the account being locked. This scenario is particularly concerning when the attacker is a former employee, insider, or anyone with prior authenticated access who may have retained network captured data or sessions artifacts.
Impact
The complete impact of this vulnerability is not yet known.
Solution
Siemens has released a new version of the Gridscale X Prepay and for version 4.2.1 and below, it is recommended to install the provided security update using the appropriates tools and procedures supplied with the product. Before deployment, all updates should be validated, and installed under the supervision of personnel with approved access within the target environment.
As a general security practice, Siemens also advises protecting network access with suitable controls such as firewalls, network segmentation, and VPNs. Systems should be configured in accordance with Siemens’ operational guidelines to ensure that the devices operate within a secure IT environment.
Acknowledgements
Thank you to the reporter, Kira The Raven Security. This document was written by Michael Bragg.

Overview
An unauthenticated HTTP request can enable telnet which may lead to remote code execution with root-level privileges.
Description
TOTOLINK manufactures routers and other networking equipment designed for small businesses and home implementations. The AX1800 routers are popular with users connecting multiple internet-capable devices.
The TOTOLINK AX1800 routers are missing authentication in /cgi-bin/cstecgi.cgi?action=telnet endpoint may result in arbitrary command execution at the administrative level. This vulnerability is being tracked by CVE-2025-13184.
Impact
The impact options include full access to configuration and filesystems. This level of access would provide an attacker the capability to modify routing DNS routing, intercept traffic, and achieve lateral movement across the local area network. There is a potential for wide area (WAN) network access if router management or telnet becomes externally reachable.
Solution
The CERT/CC is currently unaware of a practical solution to this problem. For complete remediation, a firmware update is necessary.
Mitigation Suggestions

Ensure the web management interface is not exposed to the WAN or any untrusted network. Restrict access to the administrative interface to trusted management hosts only.

Treat the X5000R router as untrusted from a security boundary point of view. Where possible, place it behind a separate firewall or router and avoid using it as the primary edge device.

Block or monitor unexpected traffic to telnet (TCP port 23) on the device. The sudden appearance of an open telnet service on the router is a strong indicator of exploitation.

Acknowledgements
Thanks to the reporter, HackingByDoing. This document was written by Laurie Tyzenhaus.