“Police CyberAlarm uses the same encryption key for both AES-CBC encryption and for HMAC-SHA256.”
UK police hand this software to businesses to monitor their networks. It reuses one key for encryption and authentication, and stripping a length prefix skips the HMAC check entirely. That leaves unauthenticated AES-CBC open to a padding oracle. The cops selling cyber safety shipped textbook mistakes from 2010.