> dmcdonald.net / advisories > ──────────────────────────
Advisories & CVEs
disclosed vulnerabilities, coordinated where the vendor engaged, full disclosure where they did not.
── 2026 ──────────────────────────────────────
Dell ThinOS 9.x full-disk-encryption bypass (recomputable GELI key)
Dell ThinOS 9.x (FreeBSD/GELI) seals a random key in the TPM, but the password that unlocks it is derived from the device's own serial numbers, CPUID, and MAC address, all printed on the label or readable from the hardware. Easier still, with no Secure Boot and no PCR binding, an attacker with physical access can patch the boot partition and have the device hand over the key, then attach the GELI volume and read the configuration database and stored credentials in the clear: a full FDE bypass. Dell ThinOS 9.x is end-of-life and Dell will not patch it, so the issue is permanent.
HP ThinPro full-disk-encryption bypass (unmeasured initramfs)
HP ThinPro seals the LUKS full-disk-encryption key to PCRs that measure the platform firmware and the GRUB binary, but not the kernel or initramfs, so only half the boot chain is measured. An attacker with physical access patches the initramfs on the unencrypted boot partition to capture the key, reboots (the TPM still unseals, because the measured state is unchanged), recovers the written-out key, and opens the encrypted volume with a detached header: a complete FDE bypass. Identical on ThinPro 8.1 and 9.0. Disclosed to HP in February 2026 and acknowledged, but no fix had shipped at time of publication.
Dell ThinOS 10 full-disk-encryption bypass (TPM sealing)
Dell's first fix bound the ThinOS 10 disk-encryption key to PCR 7. But PCR 7 measures which key signed the booted code, not the code itself, and Dell's bootloader carries Canonical's stock Ubuntu signing key. Booting a plain Ubuntu USB reproduces the same PCR 7 value, so the TPM releases the key into a root shell on the attacker's own media: a second full-disk-encryption bypass, demonstrated the morning after Dell's advisory shipped. Affects versions prior to 2605_10.2100. Full technical detail in the AmberWolf write-up; presented at DEF CON 34.
IGEL OS code execution via boot registry
IGEL OS's signed bootloader reads an unencrypted, unsigned configuration area (the boot registry) and injects its contents into the kernel command line. An attacker with physical access writes a Linux loader parameter there and reboots into a root shell with the disk unlocked. The TPM unseals normally because the trusted code is not modified; the trusted code is the problem. An IGEL-commissioned penetration test had identified this issue before our own independent rediscovery, and the original credit for it is theirs. Coordinated disclosure; fixed by IGEL in OS 12.7.6. Affects IGEL OS 11 and 12.
IGEL OS GRUB shell escape
Dropping an unsigned, empty file named igel.conf onto a partition makes IGEL's GRUB fail open while verifying it and drop to an interactive GRUB prompt. From there an attacker with physical access boots the device's own kernel with extra arguments and lands in a root shell with the disk unlocked. The binaries and measured PCRs are unchanged, so the TPM unseals normally. Affects IGEL OS 11 and 12.
Dell client BIOS weak password encoding (SPI flash recovery)
Dell client platform BIOS stores the administrator and user passwords XOR-encrypted in the SPI flash rather than as a one-way hash. A length mismatch between the password field and the key leaks the key alongside the ciphertext, so the password is recovered deterministically from a flash dump with no brute force and no known plaintext. Found jointly with Craig S. Blackie of MDSec while mapping where Dell keeps its BIOS settings on the flash.
Dell ThinOS 10 full-disk-encryption bypass (unprotected TPM key)
Dell ThinOS 10 stored the LUKS full-disk-encryption key in a TPM non-volatile index with no authorisation value, no policy, and no PCR binding. Any unauthenticated attacker with physical access could read the key straight out of the TPM with tpm2_nvread and decrypt the disk in under a minute: a complete FDE bypass on a platform marketed as fully encrypted. Affects versions prior to ThinOS10 2602_10.0765. Also found independently by Christophe Schleypen of NATO Cyber Security Centre.
── 2025 ──────────────────────────────────────
Dell ThinOS unencrypted memory dumps
Dell ThinOS thin client platform marketed as having full disk encryption stored kernel memory dumps unencrypted, exposing process memory to anyone with physical access. Found on a client build review by reaching for screwdrivers rather than a checklist.
── 2011 ──────────────────────────────────────
One Click Orgs 1.4.1 Multiple Vulnerabilities
Four issues in a community legal-structure and voting tool: stored XSS, open URL redirection, second-order SMTP injection, email-address non-uniqueness. Originated from a London Hackspace post offering free testing for community projects; vendor was responsive, fixed everything, updated production. Clean good-faith disclosure outcome.
Pro Clan Manager 0.4.2 Multiple Vulnerabilities
SQL injection via eregi null-byte bypass (CVE-2011-4556); poor random password generation reducing the keyspace to ~90,000 candidates (CVE-2011-4557). Vendor discontinued the project in response.
── 2010 ──────────────────────────────────────
VWar 1.6.1 R2 Multiple Remote Vulnerabilities
Five bugs in VWar (PHP clan management system): SQL injection, stored XSS, broken access controls, weak password generation (system-seconds seed gives ~60 candidates), static session tokens. Disclosed to the developer in April 2008. The project was officially abandoned in response, with the developer publicly stating that VWar should no longer be used. Public release followed two years later.
read full advisory · Full Disclosure post · Original archive