CVE-2025-2762

CVE-2025-2762 affects CarlinKit CPC200-CCPA. The flaw is due to misconfiguration of the SoC hardware root of trust, enabling local privilege escalation and the execution of arbitrary code in the boot context once an attacker gains low-privilege code execution. Reported details indicate the vulner...

CVE-2025-2762: Missing Immutable Root of Trust in Hardware

CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target...

CarlinKit CPC200-CCPA 安全漏洞

CarlinKit CPC200-CCPA is a wireless CarPlay and Android Auto adapter from CarlinKit. A security vulnerability exists in the CarlinKit CPC200-CCPA, which stems from a missing hardware root of trust configuration that could lead to local elevation of privilege...

CVE-2025-32963 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the spec.audiences field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it...

Blockchain Meets Adaptive Honeypots: a Trust-Aware Approach to Next-Gen IoT Security

Edge computing-based Next-Generation Wireless Networks NGWN-IoT offer enhanced bandwidth capacity for large-scale service provisioning but remain vulnerable to evolving cyber threats. Existing intrusion detection and prevention methods provide limited security as adversaries continually adapt the...

TOTOLINK A810R 安全漏洞

TOTOLINK A810R is a wireless dual-band router from China's Gion Electronics TOTOLINK. A trust management issue vulnerability exists in TOTOLINK A810R version V4.1.2cu.5182B20201026, which stems from the presence of hardcoded passwords in product.ini. An attacker can exploit the vulnerability to...

Adversarial Observations in Weather Forecasting

AI-based systems, such as Google's GenCast, have recently redefined the state of the art in weather forecasting, offering more accurate and timely predictions of both everyday weather and extreme events. While these systems are on the verge of replacing traditional meteorological methods, they al...

NVIDIA NvContainer 安全漏洞

NVIDIA NvContainer is a container management service from NVIDIA. NVIDIA NvContainer suffers from a trust management issue vulnerability that stems from a hard-coded path issue in the use of OpenSSL, which could be exploited by an attacker to cause code execution, denial of service, elevation of...

5 Reasons Device Management Isn't Device Trust​

The problem is simple: all breaches start with initial access, and initial access comes down to two primary attack vectors – credentials and devices. This is not news; every report you can find on the threat landscape depicts the same picture. The solution is more complex. For this article, we'll...

⚡ Weekly Recap: iOS Zero-Days, 4Chan Breach, NTLM Exploits, WhatsApp Spyware & More

Can a harmless click really lead to a full-blown cyberattack? Surprisingly, yes — and that's exactly what we saw in last week's activity. Hackers are getting better at hiding inside everyday actions: opening a file, running a project, or logging in like normal. No loud alerts. No obvious red flag...

Establishing Workload Identity for Zero Trust CI/CD: from Secrets to SPIFFE-Based Authentication

CI/CD systems have become privileged automation agents in modern infrastructure, but their identity is still based on secrets or temporary credentials passed between systems. In enterprise environments, these platforms are centralized and shared across teams, often with broad cloud permissions an...

Intent-Aware Authorization for Zero Trust CI/CD

This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluat...

Siemens SENTRON 7KT PAC1260 Data Manager Trust Management Issue Vulnerability

Siemens SENTRON 7KT PAC1260 Data Manager is a device for power monitoring and energy management from Siemens Germany. A trust management issue vulnerability exists in the Siemens SENTRON 7KT PAC1260 Data Manager, which stems from the presence of hard-coded credentials that can be exploited by an...

Trusted Identities for AI Agents: Leveraging Telco-Hosted ESIM Infrastructure

The rise of autonomous AI agents in enterprise and industrial environments introduces a critical challenge: how to securely assign, verify, and manage their identities across distributed systems. Existing identity frameworks based on API keys, certificates, or application-layer credentials lack t...

Dell ECS 信任管理问题漏洞

Dell ECS is an enterprise-class object storage solution from Dell Technologies. Dell ECS suffers from an information disclosure vulnerability that originates from the system failing to properly validate certificates. An attacker could exploit the vulnerability to cause an information disclosure...

The Evolution of Zero Trust Architecture (ZTA) from Concept to Implementation

Zero Trust Architecture ZTA is one of the paradigm changes in cybersecurity, from the traditional perimeter-based model to perimeterless. This article studies the core concepts of ZTA, its beginning, a few use cases and future trends. Emphasising the always verify and least privilege access, some...

On the Feasibility of Using MultiModal LLMs to Execute AR Social Engineering Attacks

Augmented Reality AR and Multimodal Large Language Models LLMs are rapidly evolving, providing unprecedented capabilities for human-computer interaction. However, their integration introduces a new attack surface for social engineering. In this paper, we systematically investigate the feasibility...

A Scalable Framework for Post-Quantum Authentication in Public Key Infrastructures

This work explores the performance and scalability of a hierarchical certificate authority framework with automated certificate issuance employing post-quantum cryptographic PQC signature algorithms. The system is designed for compatibility with both classical and PQC algorithms, promoting...

CVE-2025-3523 User Interface (UI) Misrepresentation of attachment URL

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm giving an online talk on AI and trust for the Weizenbaum Institute on April 24, 2025 at 2:00 PM CEST 8:00 AM ET. The list is maintained on this page...