Aures Komet Kiosk Mode access control

Vulnerability

A vulnerability classified as problematic exists in the Aures Komet Booking & POS Terminal running Windows 10 IoT Enterprise, in the Kiosk Mode component, up to version 20230509 [1]. The flaw involves improper access controls, allowing the kiosk's intended restrictions to be bypassed [1]. The affected product is an interactive kiosk for the fast food industry, handling orders, payments, and customer management [1].

Exploitation

The attack requires physical access to the device [1]. No authentication or prior access is needed because the attacker directly interacts with the kiosk's physical interface [1]. The exploit has been publicly disclosed, and the specific steps involve manipulating the kiosk environment to break out of the kiosk application and gain access to the underlying operating system [1].

Impact

Successful exploitation results in local privilege escalation, enabling the attacker to execute arbitrary commands or applications with higher privileges (possibly SYSTEM or Administrator), effectively seizing full control over the terminal [1]. This could lead to unauthorized access to sensitive data, payment information, or further compromise of the network.

Mitigation

As of the advisory date, no patch or firmware update was available from Aures for CVE-2023-3786 [1]. The vendor was notified in May 2023, but a fix has not been released [1]. Users should restrict physical access to kiosk devices, ensure Windows 10 IoT Enterprise is hardened, and monitor for updates from Aures. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.