The vulnerability of the DxgkDdiEscape function in NVIDIA GeForce, Quadro, and Tesla graphics drivers for Windows operating systems allows a hacker to trigger a service failure or increase their privileges.

The vulnerability of the DxgkDdiEscape function in NVIDIA GeForce, Quadro, and Tesla graphics drivers for Windows operating systems is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to cause system failures or gain...

CVE-2020-9306

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

Hardcoded credentials

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

CVE-2020-9306

CVE-2020-9306 affects Digi ConnectPort X2e devices (SolarCity/Tesla branding) with hardcoded credentials stored in a .pyc-compiled file used at boot. FireEye analysis shows password_manager.pyc in /WEB/python/ contains five plaintext credentials for the python system user, enabling web and SSH ac...

CVE-2020-9306

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)

In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s now owned by Tesla rebranded ConnectPort X2e device...

Tesla SolarCity Solar Monitoring Gateway Trust Management Issue Vulnerability

Tesla SolarCity Solar Monitoring Gateway is an application from Tesla SolarCity Solar Monitoring Gateway Tesla, USA. Solar equipment is provided. A security vulnerability exists in Tesla SolarCity Solar Monitoring Gateway through 5.46.43, which stems from the use of hardcoded credentials Digi...

Dependency Confusion Supply-Chain Attack Hit Over 35 High-Profile Companies

In what's a novel supply chain attack, a security researcher managed to breach over 35 major companies' internal systems, including that of Microsoft, Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber, and achieve remote code execution. The technique, called dependency confusion or a...

Agent Tesla Trojan 'Kneecaps' Microsoft's Anti-Malware Interface

Researchers have identified new versions of the Agent Tesla remote access trojan RAT that target the Windows anti-malware interface used by security vendors to protect PCs from attacks. The newly discovered variants have also adopted new obfuscation capabilities, raising the stakes for businesses...

Agent Tesla Malware Spotted Using New Delivery & Evasion Techniques

Security researchers on Tuesday uncovered new delivery and evasion techniques adopted by Agent Tesla remote access trojan RAT to get around defense barriers and monitor its victims. Typically spread through social engineering lures, the Windows spyware not only now targets Microsoft's Antimalware...

Agent Tesla Malware Spotted Using New Delivery & Evasion Techniques

Security researchers on Tuesday uncovered new delivery and evasion techniques adopted by Agent Tesla remote access trojan RAT to get around defense barriers and monitor its victims. Typically spread through social engineering lures, the Windows spyware not only now targets Microsoft's Antimalware...

NVIDIA Gamers Face DoS, Data Loss from Shield TV Bugs

NVIDIA has newly disclosed three security vulnerabilities in the NVIDIA Shield TV, which could allow denial of service, escalation of privileges and data loss. The NVIDIA Shield TV is a set-top gadget that acts as a hub for the smart home, streams PC games from a gaming PC to a TV; and allows loc...

How Tesla and HyperLoop accelerations help people with rocket flights

We don’t need that crazy acceleration for Tesla cars and Hyperloop for daily life in a few words. It’s a lot of fun, for sure, and some marketing feature that puts electric cars in supercars bucket. At the same time, that crazy acceleration train people to take overloads. In my personal experienc...

Agent Tesla Keylogger Gets Data Theft and Targeting Update

Six-year-old keylogger malware called Agent Tesla has been updated again, this time with expanded targeting and improved data exfiltration features. Agent Tesla first came into the scene in 2014, specializing in keylogging designed to record keystrokes made by a user in order to exfiltrate data...

CVE-2020-29440

Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module BCM. This allows an attacker who is inside a vehicle, or is otherwise able to send data over the CAN bus to start and drive the vehicle with a spoofe...

CVE-2020-29440

Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module BCM. This allows an attacker who is inside a vehicle, or is otherwise able to send data over the CAN bus to start and drive the vehicle with a spoofe...

CVE-2020-29438

Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip...

CVE-2020-29439

Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module BCM to initiate a Bluetooth wake-up action. The full VIN is visible from outside the vehicle...

CVE-2020-29438

Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip...

CVE-2020-29439

Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module BCM to initiate a Bluetooth wake-up action. The full VIN is visible from outside the vehicle...