Blue Angel Software Suite (5V Technologies) - OS Command Injection

Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter ATA and Voice over IP VoIP devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the pingaddr parameter to...

openwrt

OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows yo...

workshop_firmware_reverse_engineering

Workshop: Firmware Reverse Engineering This repository contains slides and hands-on materials for Emproof's workshop on firmware reverse engineering, presented at ScapyCon Automotive 2025. The workshop targets a technical audience with minimal security experience and teaches the fundamentals...

firmware-workshop

Hands-on Firmware Extraction, Exploration, and Emulation Join us for this hands-on demo of Unblob, the flexible firmware extractor. During this workshop session, we will extract firmware from an EV charger, dig into the firmware, and eventually emulate it so we can interact with the services in...

qemu

=========== QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also...

thetick

The Tick A simple embedded Linux backdoor. The Tick Compiling Installing Usage Media Compiling The Tick depends only on libcurl, so make sure you have the corresponding development package. For example on Debian based distributions you would do the following: sudo apt-get install libcurl-dev Once...

CLEANSTART-2026-LW63559 Security fixes in smarter-device-manager 1.20.11-r2

Package smarter-device-manager version 1.20.11-r2 fixes 1 vulnerabilities: CVE-2026-46600...

BusyBox Embedded HTTP Polling C2

POSIX/BusyBox ash HTTP polling implant for OpenWrt and embedded Linux. Pairs with listeners/multi/reversehttppolling base64 command protocol. from kittysploit import from lib.c2.embeddedhttpagent import buildembeddedhttpagentscript from lib.c2.embeddedsession import EmbeddedC2Mixin import uuid...

openwrt v24.10.8

OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows yo...

ARM LE bind TCP shell (raw)

Thumb ARM 32-bit bind shell: socket, bind, listen, accept, dup2 x3, execve /bin/sh. Null-free port encoding when possible. !/usr/bin/env python3 -- coding: utf-8 -- """ Thumb ARM bind TCP shell raw bytes for embedded Linux targets. Derived from the Xiaomi C400 factory-mode PoC bind shell Botond...

CVE-2026-9266

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure again...

CVE-2026-9266

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure again...

CVE-2026-9266: Missing Cryptographic Step

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure again...

SWUpdate security vulnerabilities

SWUpdate is an embedded Linux system update tool developed by Stefano Babic. Versions of SWUpdate prior to 2026.05 contained security vulnerabilities. These vulnerabilities were due to race conditions between the check time and the usage time, which could allow local non-privileged users to gain...

JUNG Smart Visu Server 1.1.1050 - Dos

Exploit Title: JUNG Smart Visu Server 1.1.1050- Dos CVE: CVE-2026-26235 Date: 2026-02-12 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/banyamer-security Vendor Homepage: https://www.jung.de Software Link:...

[SECURITY] Fedora 43 Update: rauc-1.15.2-1.fc43

RAUC is a lightweight update client that runs on your Embedded Linux device and reliably controls the procedure of updating your device with a new firmwa re revision. RAUC is also the tool on your host system that lets you create, inspect and modify update artifacts for your device. Service is no...

Linux Distros Unpatched Vulnerability : CVE-2026-34155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cau...

DEBIAN-CVE-2026-34155

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a...

CVE-2026-34155

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a...

CVE-2026-34155

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a...