pocs_slides

IoT / プロトコルセキュリティに関するアドバイザリ、PoC、スライド、スクリプトを共有しています。連絡先は以下のとおりです: Medium: https://medium.com/@cq674350529 Blog: https://cq674350529.github.io/ Mail: [email protected] Twitter: @cq674350529 スライド OffByOne2025: パッチ差分解析、汝は我が剣! FortiGate の 2 つの重大な N-day 脆弱性を深く掘り下げる ビデオ BHEU2023: 理論的限界を打ち破る:...

connectwise-automate-AiTM-rce

ConnectWise Automate 중간자 공격 원격 코드 실행 목차 배경 타임라인 고찰 및 교훈 책임 있는 공개 PoC 코드 ConnectWise에 제공된 보고서 요약 취약한 구성 영향 기술적 세부 사항 1. HTTP 전송 2. 불충분한 프로토콜 보안암호화 및 검증 부재 2.1 종속성 확인 및 다운로드에 대한 불충분한 검증 2.2 재생 공격 방지 부재 2.3 자체 업데이트에 대한 불충분한 검증 3. RMM 명령 및 제어 탈취 완화 방안 배경 침투 테스트의 일환으로 ConnectWise Automate 원격 모니터링 및...

Astra Linux – Vulnerability in docker.io

Moby is an open-source container framework developed by Docker Inc., distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component, dockerd, which was originally developed as “moby/moby”, is commonly referred to as Docker. Swarm Mode ...

CVE-2026-24078

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

CVE-2026-24078 Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

EUVD-2026-52731

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)

The affected products fail to properly reject certificates signed by an intermediate certificate authority that has been revoked via a Certificate Revocation List CRL. A network-based attacker who holds such a certificate can leverage it to establish a Common Industrial Protocol CIP Security...

libreswan security update

An update is available for libreswan. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the...

ALSA-2026:46397 Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...

CVE-2026-64522 net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5exfrmaddstate handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label...

CVE-2026-64522

CVE-2026-64522 affects the Linux kernel’s net/mlx5e subsystem. The issue arises in mlx5e_xfrm_add_state() when handling acquire-flow temporary SAs: software state is allocated and hardware offload setup is skipped, causing a path that jumps to the common success label to unconditionally call mlx5...

CVE-2026-64522

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5exfrmaddstate handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label...

PT-2026-64743

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5e component where the mlx5e xfrm add state function incorrectly handles acquire-flow temporary Security Associations SAs. When allocating software state an...

CVE-2026-61245

Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft component: Integration. The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterpris...

[SECURITY] Fedora 44 Update: libreswan-5.3.2-2.fc44

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

LibOSDP RMAC revert to the beginning of the session

- Issues: - SCS14 is allowed on encrypted connection osdpphy.c - No validation for RMACI is only in response to osdpSCRYPT osdpcp.c - Couldn't find anything specific in the OSDP specifications indicating it is forbidden, I'm gussing it shouldn't be allowed according from the secure connection...

gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains...

CVE-2026-48059

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nest...

CVE-2026-38707

A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target device...

CVE-2026-2379

On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with existing Security Associations, resulti...