HaXmas Hardware Hacking

Usually, when you read an IoT hacking report or blog post, it ends with something along the lines of, "and that's how I got root," or "and there was a secret backdoor credential," or "and every device in the field uses the same S3 bucket with no authentication." You know, something bad, and the...

CVE-2020-35801

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. A TFTP server was found to be active by default. It allows remote authenticated users to...

Embedded TCP/IP stacks have memory corruption vulnerabilities

Overview Multiple open-source embedded TCP/IP stacks, commonly used in Internet of Things IoT and embedded devices, have several vulnerabilities stemming from improper memory management. These vulnerabilities are also tracked as ICS-VU-633937 and JVNVU96491057 as well as the name AMNESIA:33...

Tesla Model X Data Falsification Issue Vulnerability

Tesla The Tesla Model X is a new energy vehicle from the American company Tesla. Tesla Model X vehicles versions prior to 2020-11-23 suffer from a security vulnerability that stems from having critical fobs that can accept firmware updates without signature verification.This allows an attacker to...

CVE-2020-28332

Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Versions: 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware does not perform verification of digitally signed firmware updates and is susceptible to processing and installing...

Vulnerability fixed in Intel processors

A vulnerability has been fixed in some Intel processors. The vulnerability allows a local malicious person to obtain elevated privileges. Intel has released firmware updates to fix the vulnerability. fix. More information can be found on the page below:...

Intel® SSD Advisory

Summary: Potential security vulnerabilities in multiple Intel® Solid State Drive SSD products may allow information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVE ID: CVE-2020-12309 Description: Insufficiently protected...

Intel® Wireless Bluetooth® Advisory

Summary: Potential security vulnerabilities in some Intel® Wireless Bluetooth® products may allow escalation of privilege or denial of service. Intel is releasing firmware and software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-12321 Description:...

HPSBHF03701 rev. 2 - Intel® Ethernet 700 Series Controller November 2020 Security Update

Potential Security Impact Escalation of Privilege, Denial of Service Source: HP, HP Product Security Response Team PSRT Reported by: Intel VULNERABILITY SUMMARY Intel has informed HP of potential security vulnerabilities identified in the Intel® Ethernet 700 Series Controllers which might allow...

CVE-2019-8580

Source-routed IPv4 packets were disabled by default. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. Source-routed IPv4 packets may be unexpectedly accepted...

HPSBPI03686 rev. 1 - Certain HP Enterprise MFP products: Elevation of Privilege

Potential Security Impact Elevation of privilege Source: HP, HP Product Security Response Team PSRT Reported by: HP VULNERABILITY SUMMARY A potential security vulnerability has been identified for certain HP multifunction printers MFPs. The vulnerability may lead to elevation of privilege when...

HPSBPI03687 rev. 3 - Certain HP LaserJet Printer and MFP Products and JetDirect Print Server Products - Information Disclosure

Potential Security Impact Information Disclosure Source: HP, HP Product Security Response Team PSRT Reported by: Broadcom VULNERABILITY SUMMARY A potential security vulnerability has been identified for certain HP printers and MFPs. A Broadcom wireless vulnerability known as "Kr00k" CVE-2019-1512...

Changes to ADC MPX and SDX platforms On Specific New Appliances Shipped Out To Customers

Beginning in October 2020, Citrix will shipspecific new MPX/SDX appliances withnew Manufacturing builds, Citrix ADC MPX firmware version11.1 Build 64.14 and SDX firmware versions 11.1 Build 61.117 and Build 61.115. The impactedappliance models with the new build will ship once existing stock is...

Top Tips For Home Cybersecurity And Privacy In A Coronavirus-Impacted World (Part 2)

The past few months have seen radical changes to our work and home life under the Coronavirus threat, upending norms and confining millions of American families within just four walls. In this context, it’s not surprising that more of us are spending an increasing portion of our lives online. But...

Intel® Server Board Families Advisory

Summary: Potential security vulnerabilities in some Intel® Server Board Families may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-12300 Description: Uninitialized pointer in BIOS firmware for...

Intel® Server Board M10JNP2SB Advisory

Summary: Potential security vulnerabilities in the Intel® Server Board M10JNP2SB may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-8733 Description: Improper buffer restrictions in the firmwar...

2019.2 IPU – Intel® Processor Security Advisory

Summary: Potential security vulnerabilities in System Management Mode SMM and Intel® Trusted Execution Technology TXT for some Intel® Core™ Processors and Intel® Xeon® Processors may allow escalation of privilege, denial of service or information disclosure. Intel is releasing firmware updates to...

QSnatch Data-Stealing Malware Infected Over 62,000 QNAP NAS Devices

Cybersecurity agencies in the US and UK yesterday issued a joint advisory about a massive ongoing malware threat infecting Taiwanese company QNAP's network-attached storage NAS appliances. Called QSnatch or Derek, the data-stealing malware is said to have compromised 62,000 devices since reports...

QSnatch Data-Stealing Malware Infected Over 62,000 QNAP NAS Devices

Cybersecurity agencies in the US and UK yesterday issued a joint advisory about a massive ongoing malware threat infecting Taiwanese company QNAP's network-attached storage NAS appliances. Called QSnatch or Derek, the data-stealing malware is said to have compromised 62,000 devices since reports...

HPSBHF03675 rev. 1 - Synaptics® Fingerprint Drivers that use SGX

Potential Security Impact Arbitrary Code Execution Source: HP, HP Product Security Response Team PSRT Reported By: Synaptics ® VULNERABILITY SUMMARY Synaptics has notified HP of a potential security vulnerability in certain versions of Synaptics Fingerprint Sensor Drivers using Intel® Software...