bugstropics

Hunting Bugs in the Tropics This is a repo with the slides used in my presentation "Hunting Bugs in the Tropics" at DEFCON30. It includes the Python script used to calculate the support password based on the private key obtained by breaking Aruba support's EC public key, due to its weak size 64...

CVE-2023-37073

CVE-2023-37073 Telnet default credentials can lead to information disclosure and denial-of-service DoS attacks. Steps To reporduce This affect the AP AR-5310 root@kitploit: Telnet 192.168.1.1 username:user password:user Then Boom ... You logged in Information disclosure through Telnet default...

KawaiiDeauther

KawaiiDeauther Kawaii Deauther is a pentest toolkit whose goal is to perform jam on WiFi clients/routers and spam many fake AP for testing purposes. Dependencies macchanger mdk3 nmcli Installation Dependencies will be automatically installed. root@kitploit: $ git clone...

Linux Distros Unpatched Vulnerability : CVE-2026-93094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which...

CVE-2026-93094 wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

CVE-2026-0709

Herramienta RCE Autenticada para Hikvision Wireless AP – CVE-2026-0709 Esta herramienta es una prueba de concepto en Python para probar puntos de acceso inalámbricos de Hikvision para CVE-2026-0709 , una vulnerabilidad de inyección de comandos autenticada que puede conducir a la ejecución remota ...

AZL-101180 CVE-2026-89959 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev-matrix.adm bitmap specifies the control domains assigned to the mdev...

AZL-101528 CVE-2026-89960 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the update locks are acquired and the mdev list is checked for a conflictin...

DEBIAN-CVE-2026-89957

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

DEBIAN-CVE-2026-89960

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the update locks are acquired and the mdev list is checked for a conflictin...

CVE-2026-89960

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the update locks are acquired and the mdev list is checked for a conflictin...

AZL-101433 CVE-2026-89957 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

CVE-2026-89957

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

CVE-2026-89958

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

DEBIAN-CVE-2026-89958

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

CVE-2026-89959

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev-matrix.adm bitmap specifies the control domains assigned to the mdev...

DEBIAN-CVE-2026-89955

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

AZL-101202 CVE-2026-89955 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

DEBIAN-CVE-2026-89956

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

AZL-101556 CVE-2026-89956 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...