GhostESP

La plataforma de seguridad inalámbrica nativa de ESP-IDF para ESP32. Evaluación profunda de Wi-Fi y BLE, captura y exportación de nivel investigación, y un ecosistema de aplicaciones real. Construida directamente sobre ESP-IDF de Espressif en lugar de a través del núcleo de Arduino, por lo que el...

build.prop

Pixel Prop Builder: Streamlined OTA to Build.prop Conversion Effortlessly extract and manage system properties from Pixel OTA updates with this robust automation suite. Designed for developers and enthusiasts alike, it simplifies the process of accessing and customizing Android build properties. ...

CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – Bypass de firma de actualización de firmware IoT mediante inyección de punto de orden bajo Resumen La verificación de firmware OTA de un dispositivo IoT utiliza una implementación Ed25519 defectuosa que no rechaza claves públicas con componentes de orden pequeño, lo que permite...

wyze-bulb-color-pwned

wyze-bulb-color-pwned Wireless exploit for the Wyze WLPA19CV2 color bulb Overview The Wyze Color WLPA19CV2 bulbs have a factory test mode which allows a custom OTA image to be flashed wirelessly through a specific sequence of power cycling. This project provides An implementation and guide to...

CVE-2025-65855

CVE-2025-65855 HelpFlash IoT OTA Update Multiple Vulnerabilities Summary Multiple vulnerabilities in the OTA firmware update mechanism of Netun Solutions HelpFlash IoT allow an attacker with brief physical access to execute arbitrary code. CVE ID: CVE-2025-65855 Severity: HIGH CVSS v3.1 Score: 7....

CVE-2026-100619

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

CVE-2026-100611

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100619 Capgo OTA Manifest Poisoning via app_versions.manifest Bypass

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

EUVD-2026-87714

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

CVE-2026-100619

The Capgo (capgo.app) platform is vulnerable to OTA manifest poisoning because row-level security policies on the public.manifest table can be bypassed indirectly. An attacker with an app-scoped upload/write/all API key or write+ rights can update public.app_versions.manifest for versions using t...

CVE-2026-100611

The Capgo (capgo.app backend) version ≤ 12.261.0 is vulnerable to a privilege escalation flaw because the apikey_manager role improperly restricts role binding for new API keys. When an authenticated user with apikey_manager permissions calls POST /apikey , the system fails to verify if the calle...

EUVD-2026-87706

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

sonos

sonos/amlogic haxx aquí encontrarás algunos códigos de exploit y herramientas que fueron parte de mi presentación sobre el Sonos One @ Hack in the Box amsterdam 2023. el exploit de EL3 se puede utilizar para volcar tus datos OTP/eFUSE. sonostool se puede utilizar para obtener claves de descifrado...

aeota

aeota Descifrado de AEA OTA/IPSW Prerequisites getkey.py Python 3.10+ podría funcionar con versiones anteriores, pero no probado requests pyhpke aastuff macOS 13+ macOS 14+ para soporte HPKE aastuffstandalone macOS 12+ macOS 14+ para soporte HPKE Building and Installing getkey.py pip3 install -r...

CVE-2024-4309-Analysis

🛡️ CVE-2024-4309 Xiaomi HyperOS System Updater — OTA Signature Verification Bypass & RCE ⚠️ SOLO CON FINES EDUCATIVOS — Prohibido su uso en sistemas reales. 📋 Resumen del Proyecto / Project Overview BGT-Pentest-LAB ha sido elaborado en el marco del proyecto final de ciberseguridad. Este repositorio...

GhostESP v2.2-pre1

The ESP-IDF-native wireless security platform for ESP32. Deep Wi-Fi and BLE assessment, research-grade capture and export, and a real app ecosystem. Built directly on Espressif's ESP-IDF rather than through the Arduino core, so new silicon and radio features land first and there is no abstraction...

CVE-2026-88860

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

EUVD-2026-75410

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...