VelotiSmart Wifi - Directory Traversal

VelotiSmart WiFi B-380 camera devices allow directory traversal via the uc-http service 1.0.0, as demonstrated by /../../etc/passwd on TCP port 80. id: CVE-2018-14064 info: name: VelotiSmart Wifi - Directory Traversal author: 0xAkoko severity: critical description: VelotiSmart WiFi B-380 camera...

frameworks_opt_net_wifi_CVE-2021-0466

This repository does not have a README...

CVE-2019-18370_XiaoMi_Mi_WIFI_RCE_analysis

Este repositorio no tiene un README...

fufu-sec

fufu-sec fufu-sec（Framework for Uninvited Frequency Usage）は、個人およびエンタープライズ向けワイヤレス監査のための次世代WiFiセキュリティフレームワークです。単一のブラウザダッシュボードから802.11ネットワークの攻撃面全体をカバーします。ネットワーク検出、ハンドシェイクキャプチャ、PMKID抽出、WPS悪用、不正アクセスポイント、サービス拒否、WEPクラッキング、GPUアクセラレーションによるパスワード回復をすべて1か所で実現します。...

WiFi-SpiderWeb

WiFi-SpiderWeb V2.0 — OpenWrt 능동 사이버 방어 및 허니팟 생태계 동적 Wi-Fi 인증해제 탐지기, 능동 대응 엔진 및 RSSI 삼각 측량 레이더가 포함된 실시간 웹 대시보드. USB ExtRoot에서 완전히 실행되는 저사양 OpenWrt 라우터용으로 설계되었습니다. 🏗️ 고급 아키텍처 시스템은 커널 측 BPF 필터와 스레드 안전 IPC 인프라를 통해 임베디드 하드웨어의 CPU 사이클을 최소화하도록 설계된 멀티스레드, 저오버헤드 아키텍처를 사용하여 작동합니다: root@kitploit: wlan0mon...

MouseServer-1.7.8.5-RCE

WiFi Mouse Server 1.7.8.5 - RCE WiFi Mouse Server v1.7.8.5 向けに最適化された Python 3 の概念実証（PoC）エクスプロイトです。このスクリプトは、プロトコル固有の脆弱性を利用し、自動化されたキーストローク注入によってリモートコード実行（RCE）を実現します。 このバージョンは、ホストの堅牢化制約（certutil.exe の実行制限やバイナリのダウンロードブロックなど）により従来の公開エクスプロイトが失敗するラボ環境向けに、明示的に修正・調整されています。 背景とクレジット 歴史的には、CVE-2022-3218...

Linux Distros Unpatched Vulnerability : CVE-2026-80944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller- provided data buffer in cmdnode-databuf. Several callers...

Linux Distros Unpatched Vulnerability : CVE-2026-80947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete hands the URB to rtl8xxxuqueuerxur...

Linux Distros Unpatched Vulnerability : CVE-2026-80948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label...

Linux Distros Unpatched Vulnerability : CVE-2026-80937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data...

Linux Distros Unpatched Vulnerability : CVE-2026-80934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC- TXP for AddBA req action frames MTTXD7MACTXD, set in...

Linux Distros Unpatched Vulnerability : CVE-2026-80938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork...

Linux Distros Unpatched Vulnerability : CVE-2026-89523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7925: cancel pending mlopmwork If the device is reset, suspended or unregistered within that window, the pending work can still run and access...

Linux Distros Unpatched Vulnerability : CVE-2026-80935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the addres...

AZL-100587 CVE-2026-89524 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

DEBIAN-CVE-2026-89524

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-80947

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete hands the URB to rtl8xxxuqueuerxurb, which queues it on rxurbpendinglist and, once the list grows past...

AZL-100298 CVE-2026-80947 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete hands the URB to rtl8xxxuqueuerxurb, which queues it on rxurbpendinglist and, once the list grows past...

DEBIAN-CVE-2026-80947

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete hands the URB to rtl8xxxuqueuerxurb, which queues it on rxurbpendinglist and, once the list grows past...

DEBIAN-CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...