iCSeeU

This is a suite of tools/PoCs/exploits that can be used iCSee video-call cameras via LAN and maybe non-video call cameras as well. This could easily be used to flash alternative firmwares as a replacement for the SD card update method. Note: Any memory corruption exploit will only work if your...

fitness-app

Fitbit Open Source Android App This app is based on the work of Jiska Classen, Matthias Hanreich, Steffen Kreis, Tobias Krichel, Johannes Riedel and Sven Ströher. Features Scan for BLE Fitbit devices Authenticate against Fitbit server like the original app Obtain authentication credentials from t...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69201

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

PT-2026-84238

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the cs broker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756: Improper Access Control

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue in the meshSlaveUpgfw function. An unauthenticated attacker can trigger a firmware update by sending a specially crafted MQTT message to the cs_broker component, whic...

CVE-2026-63998

A flaw was found in the Linux kernel's ethtool module. When attempting to flash transceiver modules' firmware, a validation failure could cause the ethnlopscomplete function to be skipped. This oversight means that an operation initiated by ethnlopsbegin might not be properly concluded, potential...

ESPHome vulnerable to remote code execution via arbitrary file write

SummarySecurity misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Details...

CVE-2025-15645

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the resethandler parameter during firmware flashing. An attacker can provide a crafted resethandler address pointing to invalid memory or...

PT-2026-42020

Name of the Vulnerable Software and Affected Versions Ledger Nano X affected versions not specified Ledger Flex affected versions not specified Ledger Stax affected versions not specified Description A denial of service issue exists in the MCU firmware update process. The flaw is caused by missin...

CVE-2026-0715

CVE-2026-0715 affects Moxa Arm-based industrial computers running Moxa Industrial Linux Secure. A device-unique bootloader password provided on the device can enable an attacker with physical access to reach the bootloader menu via a serial interface. The bootloader still enforces digital signatu...

PT-2025-50537

Name of the Vulnerable Software and Affected Versions Meatmeet basestation devices with ESP32 system on a chip affected versions not specified Description The ESP32 system on a chip used in Meatmeet basestation devices lacks Secure Boot functionality. Secure Boot verifies the authenticity of...

Meatmeet Pro BBQ Thermometer 安全漏洞

Meatmeet Pro BBQ Thermometer is an advanced smart thermometer from Meatmeet. A security vulnerability exists in the Meatmeet Pro BBQ Thermometer that stems from an undisabled JTAG debugging interface, which could lead to malicious firmware flashing and unauthorized network access...

EUVD-2018-15620

Malware in sbrugna...

EUVD-2025-31164

Malicious code in bioql PyPI...

EUVD-2025-28005

Malicious code in bioql PyPI...

CVE-2025-59402

Flock Safety Bravo Edge AI Compute Device BRAVO00.00local20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls...

CVE-2025-59402

Flock Safety Bravo Edge AI Compute Device BRAVO00.00local20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls...