https://critical.lt/ Critical Security — security assessments, research, and practical security guidance. en-US Sun, 04 Oct 2026 12:00:00 GMT https://critical.lt/blog/terramaster-tnas-pc-remote-code-execution/ https://critical.lt/blog/terramaster-tnas-pc-remote-code-execution/ Sun, 04 Oct 2026 12:00:00 GMT TerraMaster TNAS PC is the Windows desktop client for managing TerraMaster network-attached storage (NAS) devices. TNAS PC 5.2.548 for Windows (built on Electron 25.9.8), and likely prior versions, contains an unauthenticated vulnerability chain that enables Remote Code Execution on Windows hosts running the application. The attack requires no authentication, no user interaction, no man-in-the-middle position, and no prior pairing with a NAS device – any host on the same local network segment can carry it out. https://critical.lt/blog/asus-gpu-tweak-iii-remote-code-execution/ https://critical.lt/blog/asus-gpu-tweak-iii-remote-code-execution/ Sun, 04 Oct 2026 12:00:00 GMT ASUS GPU Tweak III is a GPU overclocking and monitoring application for graphics cards. ASUS GPU Tweak III v2.1.8.0 for Windows, and likely prior versions, contains a vulnerability chain that enables Remote Code Execution through command injection on Windows hosts running the software with the Mobile Module service component installed. The attack requires no authentication and can be triggered from the local network or potentially from a malicious website. https://critical.lt/blog/elpako-remote-code-execution/ https://critical.lt/blog/elpako-remote-code-execution/ Tue, 28 Jul 2026 15:30:00 GMT Elpako is local cryptographic middleware software that bridges web-based signing applications to USB tokens or ID card readers via PKCS#11 and PC/SC, enabling qualified electronic signatures using hardware-backed cryptographic elements. Elpako v3.3.6 for Windows, and likely prior versions, contain a vulnerability chain that enables Remote Code Execution on Windows hosts running the Elpako Root daemon. https://critical.lt/blog/tele2-pildyk-sim-card-registration-bypass/ https://critical.lt/blog/tele2-pildyk-sim-card-registration-bypass/ Mon, 17 Mar 2025 00:00:00 GMT General Overview As of January 1, 2025, Lithuania has implemented mandatory registration for new prepaid SIM cards to combat fraud and criminal activities. Registration can be completed online through mobile operators’ platforms or in person at authorized stores using an official ID, such as a passport or national identity card. This measure does not affect… https://critical.lt/blog/path-traversal-vulnerability-in-prestashop-8-2-0/ https://critical.lt/blog/path-traversal-vulnerability-in-prestashop-8-2-0/ Tue, 15 Oct 2024 00:00:00 GMT In this blog post we will briefly describe a Path Traversal vulnerability in PrestaShop open-source e-commerce platform that can be used for privilege escalation. As stated on project’s Wikipedia page it is currently used by 300,000 shops worldwide. Vulnerability Description A vulnerability has been identified in PrestaShop versions below 8.2.0 (tested in 8.1.7 and 8.1.4)… https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm/ https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm/ Fri, 12 Jul 2024 00:00:00 GMT General Overview Critical Security discovered two critical vulnerabilities in the Pantera CRM, posing significant risks to data integrity, confidentiality, and availability. These vulnerabilities were identified in versions 401.152 and 402.072 and could allow unauthorized attackers to compromise the system. Pantera CRM is a web-based business management system designed to expedite and automate various processes, and… https://critical.lt/blog/unauthenticated-remote-code-execution-and-path-traversal-in-labbis-bonus-software/ https://critical.lt/blog/unauthenticated-remote-code-execution-and-path-traversal-in-labbis-bonus-software/ Mon, 18 Sep 2023 00:00:00 GMT General Overview BONUS is a software solution for payroll and time management, offered to businesses by LABBIS as a part of their paid services. An insecure method call mechanism without proper authorization checks was discovered in version 1.2.29.0 of the software. This vulnerability allows unauthenticated attackers to call arbitrary methods from the LABBIS .NET assemblies.… https://critical.lt/blog/revealing-the-identity-of-mark-sign-users/ https://critical.lt/blog/revealing-the-identity-of-mark-sign-users/ Sun, 04 Jun 2023 00:00:00 GMT MarkSign is a solution that provides functionality of signing documents electronically. The vendor as part of its ecosystem provides “Mark Sign Software” (v1.1.0) package for Windows that enables use of USB Token or Smart Card based devices. Vulnerability in this software package enables a malicious third-party to deanonymize unsuspecting user over the WEB by means… https://critical.lt/blog/extraction-of-personally-identifiable-information-via-eparaksts-signing-extension/ https://critical.lt/blog/extraction-of-personally-identifiable-information-via-eparaksts-signing-extension/ Mon, 05 Sep 2022 00:00:00 GMT Due to the vulnerability in the “eParaksts signing extension” (v1.1.5) it is possible to extract public certificates of Latvian electronic identity card (eID) users. This can be done by embedding a malicious JavaScript code to a website. For the attack to be successful, the victim must visit the web page hosting the malicious JavaScript code… https://critical.lt/blog/how-to-correctly-protect-fintech-apps-for-android-with-biometric-authentication/ https://critical.lt/blog/how-to-correctly-protect-fintech-apps-for-android-with-biometric-authentication/ Tue, 22 Jun 2021 00:00:00 GMT During numerous mobile app security assessments we faced fintech apps for Android, that had an option to protect user data with biometric authentication, but failed to implement it in a secure way leading to authentication bypass. Although the security risk is very low due to attack-specific prerequisites, such as acquiring physical access to a mobile… https://critical.lt/blog/we-lock-unlocking-smart-locks-with-web-vulnerabilities/ https://critical.lt/blog/we-lock-unlocking-smart-locks-with-web-vulnerabilities/ Wed, 02 Jun 2021 00:00:00 GMT WE.LOCK is a smart home access solution provider that manufactures and sells smart locks. WE.LOCK smart locks can be unlocked using a fingerprint, access codes, RFID tags, a smartphone app via Bluetooth (BLE) or the physical key supplied with a lock. In this article we are focusing on a smartphone app for Android, a mobile… https://critical.lt/blog/ibm-spectrum-protect-exploiting-legacy-authentication-protocol/ https://critical.lt/blog/ibm-spectrum-protect-exploiting-legacy-authentication-protocol/ Thu, 20 May 2021 00:00:00 GMT We want to share details of a little-known attack vector that we have successfully exploited during numerous security audits. IBM Spectrum Protect is a backup solution that provides data protection for virtual, physical and cloud environments. The solution is based on a client-server architecture. IBM Spectrum Protect client nodes, administrative clients, and servers communicate using… https://critical.lt/blog/paradox-insecurity-systems-ip150-internet-module-hijacking/ https://critical.lt/blog/paradox-insecurity-systems-ip150-internet-module-hijacking/ Tue, 11 May 2021 00:00:00 GMT Paradox Security Systems is a Canadian company manufacturing alarm systems and various security devices since 1989. One of their most popular family of products are the IP150 internet modules. They are used with their SP, MG and EVO series security alarm panels to enable control and monitoring of the security alarms over the Internet. In… https://critical.lt/blog/deanonymization-of-lithuanian-e-signature-users/ https://critical.lt/blog/deanonymization-of-lithuanian-e-signature-users/ Wed, 16 Sep 2020 00:00:00 GMT In 2020, remote work and digital access to public services have become the new normal. Lithuanian citizens have multiple options for accessing different public services and signing documents online. In this article, we will discuss user privacy issues that our team has recently discovered in two independent e-signature solutions, which have been fixed by now.…