Embedded device research. The tools you’ll need

Over the last couple of years, we’ve run many courses on embedded device security. The focus is often defensive, but all the courses have an aspect of offensive: hacking demonstration and real devices so that you can understand the mindset of an attacker. To hack devices, you need tools. And the...

Cesanta Mongoose Input Validation Error Vulnerability

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features such as TCP, HTTP client and server, WenSocket client and server. An input validation error vulnerability exists in Cesanta Mongoose. The vulnerability stems from a network system or...

DEBIAN-CVE-2012-2248

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable...

CVE-2012-2248

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable...

CVE-2012-2248

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable...

CVE-2012-2248

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable...

CVE-2012-2248

CVE-2012-2248 affects dhclient 4.3.1-6 due to an embedded path variable, described across multiple sources as a path traversal issue. The available connected documents consistently identify the problem as a vulnerability in the dhclient component, but do not provide concrete exploitation steps, a...

Evernote Directory Traversal (CVE-2019-10038)

A directory traversal vulnerability exists in Evernote. This vulnerability is due to improper validation of embedded links in notes. Successful exploitation could result in arbitrary program execution...

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. This allows a malicious actor to download the updated embedded software with an empty file via FTP protocol, thereby causing a service failure.

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download the embedded software update with an empty file via FTP protocol, thereby causing service...

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. This allows a malicious entity to download the update without the presence of the software via FTP protocol, thereby causing service failure.

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download updates to the embedded software without any interaction with the software via FTP protocol...

Oracle Linux 8 : php:7.2 (ELSA-2019-3735)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3735 advisory. php 7.2.11-4 - fix underflow in envpathinfo in fpmmain.c CVE-2019-11043 Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 8 : php:7.3 (ELSA-2019-3736)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3736 advisory. php 7.3.5-5 - fix underflow in envpathinfo in fpmmain.c CVE-2019-11043 Tenable has extracted the preceding description block directly from the Oracle Linux...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Cast Iron

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR9 FP60 and Version 6 SR16 FP35 used by WebSphere Cast Iron. These issues were disclosed as part of the IBM Java SDK updates in January 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An...

[SECURITY] Fedora 31 Update: libell-0.26-1.fc31

The Embedded Linux Library ELL provides core, low-level functionality for system daemons. It typically has no dependencies other than the Linux kerne l, C standard library, and libdl for dynamic linking. While ELL is designed to be efficient and compact enough for use on embedded Linux platforms,...

CVE-2019-1441

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'...

Remote code execution

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'...

2019-11 Security Monthly Quality Rollup for Windows Embedded 8 Standard for x64-based Systems (KB4525246)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

2019-11 Security Monthly Quality Rollup for Windows Embedded 8 Standard for x86-based Systems (KB4525246)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

PT-2019-4316 · Siemens +1 · Capital Embedded Ar Classic R20-11 +4

Name of the Vulnerable Software and Affected Versions: Capital Embedded AR Classic 431-422 All versions Capital Embedded AR Classic R20-11 All versions V2303 Nucleus NET All versions Nucleus ReadyStart V3 All versions V2017.02.3 Nucleus Source Code All versions Description: A vulnerability has be...

The vulnerability in the Networking component of Java SE and Java SE Embedded software platforms allows a attacker to cause a service failure.

The vulnerability of the Networking component in Java SE and Java SE Embedded software platforms is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures using various network protocols...