PT-2021-13816

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01 Description: The issue concerns insufficient protections for the UART functionality. A malicious actor with physical access to the device can connect to the UART port via a serial connection, gaining...

Netgear RAX43 授权问题漏洞

The Netgear RAX43 is a wireless router from Netgear, Inc. A security vulnerability exists in the Netgear RAX43, which stems from insufficient protection of the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, log in...

PT-2021-15393

Name of the Vulnerable Software and Affected Versions Netgear Nighthawk R6700 version 1.0.4.120 Description The issue concerns insufficient protections for the UART console, allowing a malicious actor with physical access to the device to connect to the UART port via a serial connection and execu...

PT-2021-13821

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue concerns insufficient protections on the UART interface. A malicious actor with physical access to the device can connect to the UART port via a serial connection, login with default...

Netgear Nighthawk R6700 授权问题漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear USA. An authorization issue vulnerability exists in the Netgear Nighthawk R6700 that stems from the product's lack of adequate protection for UART console access. The vulnerability can be exploited by an attacker to execute commands as...

CVE-2021-23147: Improper Authentication

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication...

CVE-2021-20168: Improper Authentication

Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. These default...

CVE-2021-20161: Improper Authentication

Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with...

CVE-2021-35033

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the...

Design/Logic Flaw

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the...

CVE-2021-35033

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the...

CVE-2021-35033: Password in Configuration File

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the...

Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 4

The first 3 installments of our series on Rapid7's hands-on exercise from the IoT Village at this year's DefCon covered how to set up a UART header, how to determine UART status and baud rate, and how to log into single-user mode on the device. In this final post, we'll discuss how to gain full...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9534)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9534 advisory. - Bluetooth: hciuart: check for missing tty operations Vladis Dronov Orabug: 30244627 CVE-2019-10207 CVE-2019-10207 - Bluetooth: hciuart: Add basic...

Hands-On IoT Hacking: Rapid7 at DefCon IoT Village, Part 2

In our last post, we discussed how we set up Rapid7's hands-on exercise at the Defcon 29 IoT Village. Now, with that foundation laid, we'll get into how to determine whether the header we created is UART. When trying to determine baud rate for IoT devices, I often just guess. Generally, for typic...

Hands-On IoT Hacking: Rapid7 at DefCon IoT Village, Part 1

This year, Rapid7 participated at the IoT Village during DefCon29 by running a hands-on hardware hacking exercise, with the goal of exposing attendees to concepts and methods for IoT hacking. Over the years, these exercises have covered several different embedded device topics, including how to u...

GSD-2021-1001767 staging: greybus: uart: fix tty use after free

staging: greybus: uart: fix tty use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...

UVI-2021-1001767 staging: greybus: uart: fix tty use after free

staging: greybus: uart: fix tty use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...

GSD-2021-1001674 staging: greybus: uart: fix tty use after free

staging: greybus: uart: fix tty use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.70 by commit...

UVI-2021-1001674 staging: greybus: uart: fix tty use after free

staging: greybus: uart: fix tty use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.70 by commit...