This vulnerability involves a failure in the protection mechanisms of the Code 27 Companion Hub. An attacker with physical access can completely bypass kiosk restrictions by initiating a factory reset. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The CVSS 3.1 base score is 6.8, indicating a medium severity with high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker with physical access to bypass kiosk mode restrictions entirely, potentially gaining unauthorized access to the device and its data. The impact includes full compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, physical access to devices should be strictly controlled to prevent exploitation.