reaver-wps-fork-t6x

Overview Reaver implements a brute force attack against Wifi Protected Setup WPS registrar PINs in order to recover WPA/WPA2 passphrases , as described in Brute forcing Wi-Fi Protected Setup When poor design meets poor implementation. by Stefan Viehböck. Reaver has been designed to be a robust an...

cve-2022-27255

CVE-2022-27255 - Realtek eCos SDK SIP ALG バッファオーバーフロー このリポジトリには、DEFCON30 で発表された講演 "Exploring the hidden attack surface of OEM IoT devices: pwning thousands of routers with a vulnerability in Realtek’s SDK for eCos OS." の資料が含まれています。 このリポジトリの内容は次のとおりです。 analysis: CVE-2022-27255...

rtl8812au

RTL8812AU/21AU と RTL8814AU モニターモードとフレームインジェクション対応のLinuxドライバー マスターブランチは https://github.com/ulli-kroll/rtl8821au ブランチ v4.3.22-beta/rework に基づいています。 rtwversion.c によると、実際のドライバーバージョンは 4.3.20 です。 ブランチ v4.3.21 は RTL8814AU または RTL8812AU/RTL8821AU チップセット向けにビルドできます。 RTL8812AU/RTL8821AU...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

RealTek Jungle SDK - Arbitrary Command Injection

There is a command injection vulnerability on the "formWsc" page of the management interface. Successful exploitation of this vulnerability could lead to remote code execution and compromise of the affected system. id: CVE-2021-35395 info: name: RealTek Jungle SDK - Arbitrary Command Injection...

CVE-2026-51585

realtek poc rt26cx21x64.sys 漏洞利用（Realtek PCIe GbE/2.5GbE/5GbE 系列） 概述 OID 0xFF816871 将网卡的 mmio bar 映射到调用进程的虚拟地址空间中， （MmLockedPagesSpecifyCache），可通过 \.\RealTekCardGUID 从用户态访问 该 IOCTL（0x0012C818）受注册表值（DrvMode=4）控制 一旦我们获得 mmio 寄存器访问权限，就可以在环回模式下对网卡的 tx/rx 描述符环进行编程，...

CVE-2021-32537

CVE-2021-32537: RTKVHD64 における範囲外アクセスによるプール破損 これは2021年4月初めに Realtek に報告したバグです。影響を受けるドライバは RTKVHD64.sys で、多くの一般的なハードウェアで利用可能と思われます（以下のハードウェア構成でテスト済みですが、おそらくさらに多くの脆弱な機器が存在します）。 Microsoft Surface Laptop、 Microsoft Surface Book、 Microsoft Surface Pro、 Lenovo Thinkpad、 Dell XPS 13。 Realtek...

CVE-2026-36355

CVE-2026-36355：Realtek rtl819x Jungle SDK —— 通过调试 ioctl 实现未认证的内核内存读写 CVE ：CVE-2026-36355 CWE ：CWE-782, CWE-787, CWE-200 发现者 ：Daniil Gordeev 披露日期 ：2026-05-03 概述 Realtek rtl819x 非主线（out-of-tree）“Jungle SDK” 中的 rtl8192cd Wi-Fi 内核驱动程序暴露了两个 IOCTL —— writemem（0x89F5）和...

lg-webos-kexec

lg-webos-kexec 通过 kexec 在已 root 的 LG webOS 电视上启动自定义 Linux 内核 —— 在 RAM 中运行，无需绕过安全启动。 状态：进行中。 自定义内核可以被暂存并进入用户空间，但尚不能 作为可用的操作系统持续运行。 目标设备 LG 50UP81009LR（webOS 6.5，Realtek RTD2875，armv7l）。通过 Homebrew Channel 获取 root；原厂签名内核 + webOS 用户空间均未改动。 已验证的事实（实机确认） kexec -l 可以暂存（原厂或源码编译的）内核；/sys/kernel/kexecload...

cve-2021-35394-ecosystem

CVE-2021-35394 生态系统 本仓库之所以存在，是因为某个漏洞恰好让这些僵尸网络 对一个被动传感器可见——而不是因为它们彼此之间 存在关联。CVE-2021-35394（Realtek SDK 命令注入，UDP/9034）是 入选标准 ：某个家族之所以在范围内，是因为观察到它 针对受监控网络尝试利用此漏洞。一旦某个家族 进入范围，追踪便沿着该家族自身的基础设施和行为 尽可能延伸——暂存服务器、投放脚本、其他样本—— 即使这些活动本身并非此 CVE。该漏洞是被监视的那扇门， 而不是对其背后之物的断言。 目前的发现涵盖六个代码上相互独立的家族，它们共享这同一个...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: rt7-sdw: harden jackdetecthandler Realtek headset codec drivers typically check whether the card is instantiated before proceeding with the jack detection. However, rt700, rt711, and rt711-sdca lack a check on the card...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: irqchip/realtek-rtl: The refcount leak in mapinterrupts has been fixed. The offindnodebyphandle function returns a node pointer with a incremented refcount. We should use ofnodeput on it when there is no longer a need for it. Thi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fixed a deadlock in ieee80211beaconsstop. There is a deadlock in ieee80211beaconsstop, as shown below: Thread 1 | Thread 2 | ieee80211sendbeacon ieee80211beaconsstop | modtimer spinlockirqsave //1 | Wa...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mmc: rtsxusbsdmmc: Fix the return value check in mmcaddhost. The mmcaddhost function may return an error. If we ignore its return value, the memory allocated by mmcallochost will be leaked, leading to a kernel crash due to the...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: rtw88: Fixed an array overflow in rtwgettxpowerparams When using the kernel with the Undefined Behaviour Sanity Checker UBSAN enabled, the following array overflow was logged:...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: r8188eu: prevented -Ssid overflow in rtwwxsetscan This code includes a check to prevent read overflow, but another check is needed to prevent writing beyond the end of the -Ssid array...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: In rtl8xxxu, memory leaks were fixed in devices like RTL8723BU and RTL8192EU. The RTL8723BU Wi-Fi + Bluetooth combo chip may leak memory when it is connected to a Bluetooth audio device. The busy Bluetooth traffic...

Linux Distros Unpatched Vulnerability : CVE-2026-80999

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep an...