166 matches found
blackbox-fuzzing
物联网设备黑盒模糊测试——以路由器 TL-WR902AC 为例 这是我的学期论文的 HTML 版本，可在此处下载 PDF 此处。 引言 模糊测试已成为发现软件漏洞的“最有效方法之一”。许多当前与模糊测试相关的论文都以这种或类似的论断开篇 google-scholar。 我们上一篇关于“易受攻击的物联网”主题的学期论文的主要目标是找到一个内存相关漏洞，然后为这个漏洞编写利用程序。我们通过逆向固件成功找到了一个漏洞，但没有发现内存相关的漏洞。手动逆向二进制文件来发现缓冲区溢出不仅耗时，而且需要大量经验。与此同时，模糊测试正是为了成为发现此类内存相关漏洞的“最有效方式”。例如，谷歌推出了...
Emerson Dixell XWEB-500 - Arbitrary File Write
Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...
LB-LINK Routers - Unauthenticated Command Injection
LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...
CVE-2022-4096
CVE 2022 -4096 Amine TITROFINE | January 21, 2023 This experiment is destinated to demonstrate how the DNS rebinding attack works on an emulated IoT. In the setup, we have a simulated IoT device, which can be controlled through a web interface this is typical for many IoT devices. Many IoT device...
RE11S_1.11-formAccept-CommandInjection
RE11S1.11-formAccept-CommandInjection During my internship at Qi An Xin Tiangong Lab, I discovered a command injection vulnerability in the RE11S1.11 router. By analyzing the webs file in the bin directory, I found that the function formAccept contains a command injection vulnerability. The...
mud-visualizer
制造商使用描述（MUD）可视化工具 警告：mud-visualizer 目前处于测试阶段，使用风险自负。 该工具可用于可视化 JSON 格式的 MUD 文件。 目录 动机 安装 支持的 MUD 抽象 贡献 支持 引用 许可证 动机 MUD 文件是包含设备 ACL 规则的 JSON 格式纯文本文件。一个 MUD 文件可能包含数十或数百条 ACL 规则，这使得手动阅读和验证文件变得困难。mud-visualizer 将帮助您阅读、验证（并在不久的将来修改）MUD 文件。 安装 使用以下命令安装并运行 mud-visualizer： root@kitploit: $ git clone...
CVE-2021-27289
🐝 CVE-2021-27289: Playback Protection Bypass on Ksix Zigbee devices 📑 Table of Contents Before We Get Serious The Story Behind This CVE Vulnerability Affected Devices Technical Details Attack Scenario Impact Proof of Concept Demo Videos Original Blog Post Researcher Zigbee Basics Background and...
IoT_vuln
POC for TOTOLINK devices: TOTOLINK LR350: CVE-2024-10654 login bypass TOTOLINK T6: CVE-2025-6916 login bypass - for a deeper dive into this CVE, read more at: https://anduinbrian.github.io/posts/blogs/totolink-t6-v3/...
CVE-2026-92943
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...
CVE-2025-27840-WIP
CVE-2025-27840-WIP 针对 CVE-2025-27840 的进行中工作 CVE-2025-27840 概述 CVE-2025-27840 是一个中等级别漏洞（CVSS 6.8 ），影响乐鑫 ESP32 蓝牙芯片 ，该芯片已集成到全球超过 10 亿台物联网设备中。该缺陷涉及 29 条未记录的控制器接口（HCI）命令 ，可能实现未经授权的内存访问和设备控制。 🔧 关键技术细节 影响 ESP32 固件版本 2025-03-06 关键命令0xFC02 允许直接写入内存 利用该漏洞需要物理访问权限或特权权限 ⚠️ 潜在风险 设备伪造和未经授权的数据访问 网络横向渗透和持续性威胁...
CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...
CVE-2026-92943
AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 (Python 3.7+) contain an improper certificate validation flaw in the MQTT client TLS connection layer. An adversary-in-the-middle can present a certificate issued for an unrelated hostname by a CA already in the device trust store, thereb...
CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...
CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...
EUVD-2026-82378
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...
CVE-2026-77966 Ebyte NA111-M Missing Authorization
The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...
MINI-RG49-H5RP-JFGR
Bulletin has no description...
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham an...
PT-2026-73233
damn so check this out... basically some crazy smart researchers found out that a bad SIM card can straight up hijack IoT devices like EV chargers and industrial routers using this sneaky old command called RUN AT. if an attacker gets physical access to stick a malicious card in there, it gives...
