CVE-2022-2484

The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs...

PT-2025-1580

Name of the Vulnerable Software and Affected Versions Supermicro BMC firmware versions affected versions not specified Description The Baseboard Management Controller BMC firmware has a flaw in its firmware image authentication design. An attacker can modify the firmware to bypass BMC inspection...

CVE-2024-52330

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates...

CVE-2024-52330

ECOVACS lawnmowers and vacuums are affected by CVE-2024-52330 due to improper TLS certificate validation. This allows an unauthenticated attacker to read or modify TLS traffic, potentially tampering with firmware updates. The vulnerability affects the product’s TLS handling in the affected device...

CVE-2024-7726 Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7

There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide...

CVE-2024-7726

The CVE-2024-7726 entry describes an unauthenticated, externally accessible JTAG port on Kioxia CM6, PM6 and PM7 SSDs. The JTAG port is exposed on the drive’s circuit board, allowing a physically proximate attacker to access the two main CPU cores’ firmware/memory, execute arbitrary code, alter f...

CVE-2024-10772 SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification

Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device...

CVE-2024-10772 SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification

Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device...

CVE-2024-47865

Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may update or downgrade the firmware on the device...

PT-2024-38167

Name of the Vulnerable Software and Affected Versions: eWeLink affected versions not specified Description: A local attacker can decrypt TLS communication and extract secrets to clone the device via flashing modified firmware due to a missing SSL pinning implementation. Recommendations: At the...

How to root an Android device for analysis and vulnerability assessment

TL;DR Rooting is useful for Android assessments The process is relatively simple It will wipe all user data from the device and void any warranty Introduction For mobile testing, be it for apps or hardware, having complete control over the device is essential for analysis and vulnerability...

CVE-2023-41921

A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achievin...

CVE-2023-41921 Download of Code Without Integrity Check in Kiloview P1/P2 devices

A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achievin...

PT-2024-13012 · Kiloview · P1/P2 +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A vulnerability exists that allows attackers to download and execute code from a remote location without properly verifying its origin and integrity. This can enable attackers to...

CVE-2023-35841

CVE-2023-35841 describes an IOCTL access-control weakness in the Phoenix WinFlash Driver on Windows, enabling privilege escalation and potential modification of system firmware. The issue affects WinFlash Driver versions before 4.5.0.0, via an exposed IOCTL that allows reading/writing to hardware...

Sangoma cg6kwin2k.sys 安全漏洞

Sangoma cg6kwin2k.sys is a configuration program from Sangoma Canada. A security vulnerability exists in Sangoma cg6kwin2k.sys versions prior to 2.1.7.0, which stems from vulnerability to insufficient IOCTL access control, where by sending a specific IOCTL request, a user without administrator...

PT-2023-22786 · Unknown · Wireless Card Firmware

Name of the Vulnerable Software and Affected Versions: Wireless card firmware affected versions not specified Description: The issue concerns the firmware update package for the wireless card, which is not properly signed and can be modified. Additionally, the configuration from the PCU can be...

PT-2023-6917 · Phoenix · Winflash Driver

Name of the Vulnerable Software and Affected Versions: WinFlash Driver versions prior to 4.5.0.0 TdkLib64.sys affected versions not specified Description: The issue is related to insufficient access control in the Phoenix WinFlash Driver on Windows, allowing privilege escalation and modification ...

Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways

Several versions of the SICK Flexi Soft Gateways FX0-GENT, FX0-GMOD, FX0-GPNT and SICK Flexi Classic Gateway UE410 provide a Telnet interface for debugging, which is enabled by factory default. No password is set in the default configuration. If the password is not set by the customer, a remote...

CVE-2023-27389

Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service DoS condition, and/or execute arbitrary code...