Xiaomi-C200-Firmware-Analysis

范围 在本仓库中，我将展示我是如何在没有常见的暴露引脚/测试点的情况下访问 UART 接口的，利用 U-Boot 和一些技巧在早期阶段获得 root 权限，并最终转储固件。 初步侦察 从 PCB 上可以明确看出几个关键点： 芯片 → T31 君正处理器 闪存 → SOIC-8 SPI NOR 类型 潜在的 UART 测试点 首先，我尝试了那些最直接的 UART 访问候选点，有 4 个排成一排的测试点，看起来像是 Tx、Rx、地线和电源，但用万用表测试时读数不对，如图所示。我尝试了大多数其他测试点，仍然找不到正确的读数，因此我不得不改变策略。 获得立足点...

zyxel-p870hn-hardware-hacking

从裸露 PCB 到 root：通过 UART 硬件破解 ZyXEL P-870HN 两张无标签路由器板的手机照片 → 串口控制台 → 认证绕过 → root shell —— 在我自己的硬件上复现这条真实存在、至今未修补的攻击链 CVE-2025-0890 （隐藏的 supervisor 账户）+ CVE-2024-40891 （CLI 命令注入）。 作者：damik0 · 2026-08-13 · 硬件破解实战记录 root@kitploit: 📷 PCB 照片 ─▶ 🔬 芯片侦察 ─▶ 🏷️ 型号识别 ─▶ 📍 找到 UART J2 └─▶ 🔌 串口控制台 ─▶ 🚪 隐藏账户 ─▶ ⛓️...

CVE-2026-75371

An integer handling flaw in the cobsdecode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service DoS via a crafted input...

CVE-2026-75371

An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software (commit eaf90ec) allows physically-proximate attackers with UART access to trigger a Denial of Service via a crafted input. The CISA SSVC assessment rates exploitation status as proof-of-concept , automatable, ...

CVE-2026-75371

An integer handling flaw in the cobsdecode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service DoS via a crafted input...

CVE-2026-36174

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface...

AZIOT 1 Node Smart Switch 安全漏洞

AZIOT 1 Node Smart Switch is a single-node intelligent switching device developed by the Indian company AZIOT. Version 1.1.9 of AZIOT 1 Node Smart Switch contains a security vulnerability. This vulnerability stems from improper access control of the UART debugging interface, which may allow...

Multiple IP-KVM Vulnerabilities

RISK EVALUATION Multiple KVM products GL-iNet GL-RM1, Angeet ES3 KVM, Sipeed NanoKVM, and JetKVM are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow a remote, unauthenticated attacker to take complete control of a vulnerable product. 2. RECOMMENDED...

CVE-2025-65396

Affected product: Blurams Flare Camera (versions 24.1114.151.929 and earlier). Vulnerability cause: In the boot process, a read error from the SPI flash memory is induced by shorting a data pin to ground, allowing a physically proximate attacker to hijack the boot mechanism and gain a bootloader ...

CVE-2022-50625

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: avoid SBSA UART accessing DMACR register Chapter "B Generic UART" in "ARM Server Base System Architecture" 1 documentation describes a generic UART interface. Such generic UART does not support DMA. In current...

EUVD-2020-20583

Malware in sbrugna...

EUVD-2025-13275

Malicious code in bioql PyPI...

EUVD-2022-46145

Malicious code in bioql PyPI...

CVE-2025-10991 Root Access via UART

The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907...

CVE-2023-30351

Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service or UART by using the exposed credentials...

CVE-2020-28096

FOSCAM FHD X1 1.14.2.4 devices allow attackers with physical UART access to login via the ipc.fos password...

CVE-2025-44039

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CVE-2025-32886

An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB Shell, allowing someone with local access to gain information about the protocol and intercept sensitive data...

PT-2024-4602 · Asus · Asus Rt-N12+ B1

Name of the Vulnerable Software and Affected Versions: ASUS RT-N12+ B1 versions affected versions not specified ASUS RT-N12 D1 versions affected versions not specified Description: The issue is related to insufficient access control in the UART interface of the firmware of ASUS routers, allowing...

CVE-2023-49515

Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components...