CVE-2019-16733

The CVE-2019-16733 entry describes a root-level command injection in Petwant PF-103 firmware (4.22.2.42) and Petalk AI (3.2.2.30) via processCommandSetUid() in libcommon.so. Exploitation details are not publicly provided in the available documents, but NVD assigns a CVSSv3.1 base score of 9.8 (CR...

CVE-2019-16737

Affects Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30. The libcommon.so function processCommandSetMac() can be triggered remotely to execute arbitrary commands as root, due to a vulnerable implementation in the command handling. The CVE entry records high-severity impact (remote, no au...

CVE-2019-16734

Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

CVE-2019-16734

CVE-2019-16734 affects Petwant PF-103 and Petalk AI with firmware versions 4.3.2.50 / 3.2.2.30, where the TELNET server uses default credentials, enabling remote attackers to execute arbitrary commands as root. Red Hat and other feeds corroborate the default-credential issue, describing it as a t...

CVE-2019-16732

The CVE-2019-16732 entry describes an unencrypted HTTP channel for firmware upgrades in Petalk AI and PF-103, enabling a man-in-the-middle to inject and execute arbitrary code with root privileges. Affected components are the firmware upgrade process on Petalk AI and PF-103 devices; root cause is...

Finding a common language to describe AI security threats

As artificial intelligence AI and machine learning systems become increasingly important to our lives, it’s critical that when they fail we understand how and why. Many research papers have been dedicated to this topic, but inconsistent vocabulary has limited their usefulness. In collaboration wi...

PT-2019-14805 · Petwant +1 · Libcommon.So +2

Name of the Vulnerable Software and Affected Versions: Petwant PF-103 firmware version 4.22.2.42 Petalk AI version 3.2.2.30 Description: The issue allows remote attackers to execute arbitrary system commands as the root user due to a problem in the processCommandSetMac function of libcommon.so...

RTTM - Real Time Threat Monitoring Tool

Monitoring possible threats of your company on Internet is an impossible task to be achieved manually. Hence many threats of the company goes unnoticed until it becomes viral in public. Thus causing monetary/reputation damage. This is where RTTM comes into action. RTTM Real Time Threat Monitoring...

Deployment Isn’t the Final Step – Monitoring Machine Learning Models in Production

Unless you’ve been living in a cave for the last decade, you’ve probably heard of the concept of a machine learning system at least once in your life. Whether it’s auto-translation, auto-completion, face or voice recognition, recommendation systems or autonomous driving, AI-based systems can be...

A week in security (November 18 – 24)

Last week on Malwarebytes Labs, we looked at stalkerware’s legal enforcement problem, announced our cooperation with other security vendors and advocacy groups to launch Coalition Against Stalkerware, published our fall 2019 review of exploit kits, looked at how Deepfake on LinkedIn makes for...

Tainted Data Can Teach Algorithms the Wrong Lessons

Researchers show how AI programs can be sabotaged by even subtle tweaks to the data used to train them...

Heap corruption vulnerability in Xiaomi AI Speaker-mDNS service

Xiaomi AI Speaker is a smart speaker product from Xiaomi. A heap corruption vulnerability exists in the Xiaomi AI Speaker-mDNS service. The vulnerability is due to the program service in the parsing of the request message there is a boundary check is not strict, resulting in the arbitrary write o...

Xiaomi AI Speaker-mDNS service suffers from denial of service vulnerability

Xiaomi AI Speaker is a smart speaker product from Xiaomi. A denial of service vulnerability exists in the Xiaomi AI Speaker-mDNS service. The vulnerability is caused by the program service failing to adequately determine malformed messages when parsing request messages, causing the parsing thread...

Report: The Government and Tech Need to Cooperate on AI

It also warns that AI-enhanced national security apparatus like autonomous weapons and surveillance systems will raise ethical questions...

CVE-2015-9501

The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root...

Design/Logic Flaw

The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root...

Microsoft’s 4 principles for an effective security operations center

The Microsoft Cyber Defense Operations Center CDOC fields trillions of security signals every day. How do we identify and respond to the right threats? One thing that won’t surprise you: we leverage artificial intelligence AI, machine learning, and automation to narrow the focus. But technology i...

A week in security (October 7 – 13)

Last week on Malwarebytes Labs, we peered into the possible future of cybersecurity insurance, described the process for securing today’s managed service provider, and provided an in-depth explainer on the business espionage tactic known as “war shipping.” Further, in considering the intersection...

Pixel Perfect. Enhanced Optimizations Focused on Customer Experience

I remember the days when brands captivated users online with dancing aliens LowerMyBills.com and Elf Yourself advertising campaigns OfficeMax. In this new digital era, however, customers are smarter, more powerful, and dictate more than ever how and when they interact with brands. More important...

New Comic Videos Take CISO/Security Vendor Relationship to the Extreme

Today's CISOs operate in an overly intensive environment. As the ones who are tasked with the unenviable accountability for failed protection and successful breaches, they must relentlessly strive to improve their defense lines with workforce education, training their security teams and last but...