CVE-2020-10135-BIAS

CVE-2020-10135-BIAS CVE 2020-10135 المعروف أيضًا باسم BIAS هجوم انتحال البلوتوث يبدو أنه بعد فترة وتجاوز بعض العقبات تمكنت من تنفيذ BIAS هجوم انتحال البلوتوث CVE 2020-10135. انتحلت اتصال Samsung S3 Neo+ مع مضيف Linux. شيء رائع. شكرًا لـ Internalblue و BIAS PoCs. من وجهة نظري، اكتشفت أن كل ما تحتا...

bluffs

BLUFFS Введение Этот репозиторий содержит код, относящийся к BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses. Аннотация статьи Bluetooth — это повсеместная технология беспроводной связи. Миллиарды устройств используют её в чувствительных приложениях и для обмена личными данными...

EUVD-2026-67290

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

CVE-2026-69658

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

CVE-2026-69658 Ebyte NA111-M Cleartext Transmission of Sensitive Information

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

CVE-2026-69658

Ebyte NE2-D11 is vulnerable to cleartext transmission of MQTT credentials and control traffic , allowing network-level attackers to intercept sensitive data. The exposed information may enable unauthorized device impersonation and disruption of messaging functions . The vulnerability is rated CRI...

CVE-2026-69658 Ebyte NA111-M Cleartext Transmission of Sensitive Information

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

PT-2026-82777

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

Exploit for Improper Authentication in Google Android

BT-HID-PoC — CVE-2023-45866 Interactive Wizard DISCLAIMER...

EUVD-2026-36529

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register o...

CVE-2026-50101 Naxclow IoT Platform Not using password aging

Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintai...

PT-2026-48958

Name of the Vulnerable Software and Affected Versions Naxclow affected versions not specified Description The platform API that returns device relay registration details fails to verify if the requester is the legitimate device or owner, exposing a persistent credential. An actor capable of...

Naxclow IoT Platform

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to impersonate devices, intercept or manipulate communications, harvest sensitive credentials at scale, or gain unauthorized access. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

CVE-2026-5768

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

CVE-2026-25599

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

CVE-2026-25599

CVE-2026-25599 involves Orca heat pump devices communicating with the Orca server over unencrypted HTTP, with missing authentication and input validation on aggregated data. This combination enables stored XSS in the heat pump web control interface and potential cookie theft, as well as attacker ...

EUVD-2026-33617

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

PT-2026-45397

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

CVE-2026-5768

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

EUVD-2026-33368

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...