159 matches found
mud-visualizer
निर्माता उपयोग विवरण MUD विज़ुअलाइज़र चेतावनी: mud-visualizer वर्तमान में बीटा संस्करण है। अपने जोखिम पर उपयोग करें। इस उपकरण का उपयोग JSON प्रारूप में MUD फ़ाइलों को विज़ुअलाइज़ करने के लिए किया जा सकता है। विषय-सूची प्रेरणा स्थापना समर्थित MUD अमूर्तताएँ योगदान सहायता उद्धरण लाइसेंस प्रेरणा MUD...
RE11S_1.11-formAccept-CommandInjection
RE11S1.11-formAccept-CommandInjection During my internship at Qi An Xin Tiangong Lab, I discovered a command injection vulnerability in the RE11S1.11 router. By analyzing the webs file in the bin directory, I found that the function formAccept contains a command injection vulnerability. The...
IoT_vuln
POC for TOTOLINK devices: TOTOLINK LR350: CVE-2024-10654 login bypass TOTOLINK T6: CVE-2025-6916 login bypass - for a deeper dive into this CVE, read more at: https://anduinbrian.github.io/posts/blogs/totolink-t6-v3/...
CVE-2021-27289
🐝 CVE-2021-27289: تجاوز حماية إعادة التشغيل على أجهزة Ksix Zigbee 📑 جدول المحتويات قبل أن نبدأ بجدية القصة وراء هذا CVE الثغرة الأجهزة المتأثرة التفاصيل التقنية سيناريو الهجوم الأثر إثبات المفهوم فيديوهات العرض المقال الأصلي في المدونة الباحث أساسيات Zigbee الخلفية والدافع التجارب المبكرة الاكتشا...
Emerson Dixell XWEB-500 - Arbitrary File Write
Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...
LB-LINK Routers - Unauthenticated Command Injection
LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...
CVE-2022-4096
CVE 2022 -4096 Amine TITROFINE | January 21, 2023 This experiment is destinated to demonstrate how the DNS rebinding attack works on an emulated IoT. In the setup, we have a simulated IoT device, which can be controlled through a web interface this is typical for many IoT devices. Many IoT device...
blackbox-fuzzing
Фаззинг IoT-устройств методом чёрного ящика на примере роутера TL-WR902AC Это HTML-версия моей курсовой работы, которую можно скачать в формате PDF здесь. Введение Фаззинг стал «одним из наиболее эффективных способов» поиска ошибок в программном обеспечении. С этого или подобных утверждений...
CVE-2025-27840-WIP
CVE-2025-27840-WIP A Work-In-Progress for CVE-2025-27840 CVE-2025-27840 Overview CVE-2025-27840 is a medium-severity vulnerability CVSS 6.8 affecting Espressif ESP32 Bluetooth chips , which are integrated into over 1 billion IoT devices globally. The flaw involves 29 undocumented Host Controller...
CVE-2026-77966 Ebyte NA111-M Missing Authorization
The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...
MINI-RG49-H5RP-JFGR
Bulletin has no description...
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham an...
Exploit for CVE-2026-38422
CVE-2026-38422: Remote Code Execution via Combined Buffer Over...
vulnerability-research
Vulnerability Research & Responsible Disclosure Shivam Paji...
SenseLive X3050 跨站请求伪造漏洞
The SenseLive X3050 is a data collection and environmental monitoring device designed for IoT scenarios by SenseLive Corporation. The SenseLive X3050 has a cross-site request forgeing vulnerability. This vulnerability arises from the lack of protection against cross-site request forgeing in the w...
CVE-2022-42054
Multiple stored cross-site scripting XSS vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Company Name and Description text fields...
CVE-2022-42055
Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...
CVE-2021-22547
In IoT Devices SDK, there is an implementation of calloc that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading th...
CVE-2025-66647 RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first...
