74 matches found
laf
LoRaWAN 감사 프레임워크 - 알파 버전 IoT 배포는 계속해서 성장하고 있으며, 그 상당한 성장의 일부는 전 세계 수백 개 도시스마트 시티, 산업 및 가정에 배포된 수백만 개의 LPWAN저전력 광역 네트워크 센서로 구성됩니다. 가장 많이 사용되는 LPWAN 기술 중 하나는 LoRa이며, LoRaWAN은 네트워크 표준MAC 계층입니다. LoRaWAN은 내장된 암호화를 사용하는 보안 프로토콜이지만, 구현 문제와 취약점으로 인해 대부분의 현재 배포의 보안이 영향을 받습니다. 이 프로젝트는 LoRaWAN 인프라의 보안을 감사하거...
Loracrack
Loracrack - LoRaWANセッションクラッカー 脆弱な、または共有されたアプリケーションキーを悪用するPoC Applied RiskのSipke Mellemaによって作成されました これは、複数のLoRaWANノードで同じAppKeyを使用することの危険性を実証するためのProof-of-Conceptです。 このリポジトリには、キャプチャしたパケットからLoRaWANセッションキーをクラックするためのツールボックスが含まれています。攻撃シナリオでは、AppKeyを知っているがハンドシェイクを見逃した場合、またはAppKeyがランダムではなく推測可能な場合を想定しています...
CVE-2026-13479
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13480
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
EUVD-2026-66556
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480
CVE-2026-13480 is an out-of-bounds read in the Zephyr RTOS LoRaWAN TS004 Fragmented Data Block Transport (FUOTA) downlink handler (frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c). The handler fails to validate remaining payload length before casting to a 10-byte set...
EUVD-2026-66555
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479
CVE-2026-13479 is an out-of-bounds read in the LoRaWAN clock-synchronization service of Zephyr RTOS (subsys/lorawan/services/clock_sync.c). When processing the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) downlink, the handler reads a 4-byte time correction and 1-byte token without verifying that 5 bytes...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...
EUVD-2026-66229
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...