CVE-2026-36028: Code 27 Companion Hub Factory Reset Authentication Bypass

Technical summary

The Code 27 Companion Hub contains an authentication or access control weakness (CWE-288) in its factory reset functionality. The protection mechanisms that enforce kiosk mode restrictions are not properly validated or protected during the reset process, allowing an attacker with physical access to restore the device to factory defaults without authentication. Once reset, the attacker can bypass all kiosk-mode protections, gaining full access to the system with the privileges of the device. The CVSS score of 6.8 (MEDIUM) reflects that while the impact is high across confidentiality, integrity, and availability, the attack vector is physical-only with low complexity.

Business impact

Organizations deploying Code 27 Companion Hub devices in shared, public, or semi-supervised environments face operational and security risks. Attackers with physical access can reset devices to factory state, potentially exfiltrating sensitive data displayed or stored on the kiosk, modifying content or functionality, or rendering the device inoperable. This is particularly concerning in retail, hospitality, healthcare, and government settings where kiosks handle customer interactions or restricted information. Affected businesses may experience service interruptions, data breaches, compliance violations, and loss of customer trust.

Affected systems

The vulnerability affects Code 27 Companion Hub devices. Specific version information is not provided in the source data; contact the vendor for a definitive list of affected product versions or verify against Code 27's security advisory.

Exploitability

Exploitation requires physical access to the device and is relatively straightforward—an attacker can simply initiate a factory reset, typically via physical buttons or bootloader interface, without needing authentication credentials or specialized tools. The low attack complexity and lack of prerequisites (no user interaction required, no authentication needed) make this practical for attackers who can physically access the device. However, the physical access requirement significantly limits the attack surface in most organizational contexts.

Remediation

Verify that Code 27 has released a firmware or software patch that implements proper authentication or protection of the factory reset function. Patch management should prioritize devices deployed in public or semi-supervised environments. Additionally, implement compensating controls: secure physical access to kiosk devices via tamper-evident enclosures, locked mounting, surveillance, or restricting placement to staff-only areas. Consider disabling or password-protecting the factory reset function if the firmware or device configuration allows. Organizations should also review whether kiosk mode restrictions are the sole security control and implement layered defenses.

Patch guidance

Consult Code 27's official security advisory to identify patched firmware versions for the Companion Hub. Test patches in a non-production environment to ensure compatibility with existing kiosk configurations and dependent systems. Prioritize patching devices in high-risk locations (public-facing, unsupervised). Verify after patching that the factory reset function is properly protected and that kiosk restrictions cannot be bypassed via reset.

Detection guidance

Monitor for unexpected factory resets on Code 27 Companion Hub devices via device logs, firmware version changes, or configuration rollbacks. Implement alerting on failed or successful access to bootloader or reset functions. Review physical access logs and surveillance footage for unauthorized handling of devices. Check for suspicious configuration changes immediately following device unavailability. Log and alert on any changes to kiosk mode settings or restrictions.

Why prioritize this

Although CVE-2026-36028 carries a MEDIUM CVSS score, prioritization depends on deployment context. Organizations with devices in public or low-supervision environments should treat this as higher priority due to ease of exploitation and high impact. The vulnerability requires physical access, which significantly reduces risk in secured facilities. However, the complete bypass of kiosk protections and exposure of confidentiality, integrity, and availability warrant prompt patching. Organizations should assess their physical security posture and device deployment model to determine internal severity.

Risk score, explained

CVSS 6.8 (MEDIUM) reflects high impact across all three security dimensions (confidentiality, integrity, availability) but is tempered by the requirement for physical access (AV:P). Attack complexity is low, no privileges are required, and the scope is unchanged. While the damage potential is substantial, the physical access barrier significantly reduces real-world likelihood in most corporate environments. Organizations with strong physical security should assess this as lower risk; those with public-facing or inadequately secured kiosks should assess as higher.

Frequently asked questions