psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

Mediatrix-CVE-2022-43096

CVE-2022-43096 CVSS v3.1 Vector: AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N 7,3 Description Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. Vulnerability Type Incorrect Access Control Vendor of Product Mediatrix Affected Product Code Base Mediatrix 4102 -...

zyxel-p870hn-hardware-hacking

От голой печатной платы до root: аппаратный взлом ZyXEL P-870HN через UART Две фотографии немаркированной платы роутера с телефона → последовательная консоль → обход аутентификации → root-оболочка — воспроизведение реальной, до сих пор не пропатченной цепочки CVE-2025-0890 скрытая учётная запись...

CVE-2024-36842-Backdooring-Oncord-Android-Sterio-

CVE-2024-36842 Backdooring-Oncord+ Android-Sterio We have conducted vulnerablity assessment on one of the most selling after marrket car infotainment unit. Creating Persistent Backdoor on Oncord+ android/ios car infotainment unit using malicious script! About Device: Android version : 12 Kernel...

ch55x_firmware_extractor

CH55x firmware extractor The CH55x firmware extractor is used to read out firmware from CH55x integrated circuits. There is no in-built support in the devices for directly reading out the firmware through the bootloader. However, there is a functionality to verify the firmware contents 8 bytes at...

Xiaomi-C200-Firmware-Analysis

The Scope In this repo i will show how i got access to the UART interface even without the common set of exposed pins / test pads, using U-Boot and tricks to gain root on an early stage and eventually dumping the firmware Initial Reconnaissance There are a few key things clear from the PCB Chip...

ps5-uart

24-контактный разъём рядом с salina EDM-010 root@kitploit: emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. притяжка к земле при загрузке emc заставляет ROM emc войти в uart shell @ 460800 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3, опускается в ноль при сбросе emc 9 0v? 10 gnd 11 titania uar...

CP-XR-DE21-S--4G-Router-Vulnerabilities

CP-XR-DE21-S--4G-Router-Vulnerabilities This report is for CVE-2025-44039 reserved for Router UART vulnerability assigned to Discoverer Yashodhan Vivek Mandke. Please download the report pdf in this repositoy...

CVE-2025-65731

CVE-2025-65731 CWE-1191: On-Chip Debug and Test Interface With Improper Access Control UART Root Shell Access on D-Link DIR-605L Hardware F1, Firmware V6.02CN02 Summary A critical hardware security vulnerability has been identified in the D-Link DIR-605L router, Hardware Version F1, Firmware...

CVE-2025-45512

U-Boot 1.1.3 Exploit PoC Usage Guide Introduction This Proof of Concept PoC was created to verify vulnerabilities in the U-Boot bootloader version 1.1.3 compiled on August 27, 2019. The code implements five different vulnerabilities relevant to the OWASP IoT Security Testing Guide ISTG categories...

EUVD-2026-81275

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

CVE-2026-89034

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

CVE-2026-89034 TCH QRing R20_B006 Unauthenticated BLE Access

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

CVE-2026-89034

TCH QRing smart ring model R20_B006 (firmware RT09R20_1.00.00_250318) contains an unauthenticated Bluetooth Low Energy vulnerability. The exposed Nordic UART Service enforces no client authentication or command authorization, allowing any nearby attacker within BLE range to connect directly, bypa...

CVE-2025-67399

CVE-2025-67399 Vulnerability Summary The AIRTH Smart Home AQI Monitor uses a CB3S Bluetooth SoC based on the BK7231N chipset with Software version number: 2.1.17. By physically accessing the device and identifying the SoC, the exposed UART debug/programming pins were located using the publicly...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - tty: serial: Fixed a refcount leak issue in uccuart.c In socinfo, offindnodebytype will return a node pointer with the refcount incremented. We should use ofnodeput when it is no longer needed...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFC: pn533 – The UART receive buffer was bound incorrectly. The pn532receivebuf function appends every incoming byte to dev-recvskb, and only resets the buffer after pn532uartrxisframe recognizes a complete frame. A continuous...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Update uartdriverregistered upon driver removal The removal of the last MAX3100 device triggers the removal of the corresponding driver. However, the code does not update the respective global variable. After the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: serial: protect uartportdtrrts in uartshutdown as well. The commit af224ca2df29 serial: core: Prevent unsafe uart port access, part 3 added several uport == NULL checks. One such check was added to uartshutdown. Therefore, the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baudbase can result in uartclk being zero, which will cause a divide by zero error in uartgetdivisor. The check for uartclk...