emba

EMBA 嵌入式设备固件安全分析器 EMBA 被设计为面向渗透测试人员、产品安全团队、开发人员和产品负责人的核心固件分析与 SBOM 工具。它支持完整的安全分析流程，从 固件提取 开始，通过仿真进行 静态分析 和 动态分析 ，构建 SBOM，最终生成基于 Web 的漏洞报告。 EMBA 能够自动发现固件中可能存在的弱点和漏洞，例如不安全的二进制文件、陈旧过时的软件组件、可能存在漏洞的脚本或硬编码密码。 EMBA 是一个命令行工具，同时可以生成易于使用的 Web 报告以供进一步分析。 EMBA 帮助渗透测试人员、产品安全团队和开发人员识别固件镜像中的弱点和漏洞。 EMBA...

Linksys-WRT54GL-Exploitation

Del soldador a la shell: explotación completa del hardware del router Linksys WRT54GL CVE-2022-43973 Un viaje de investigación de seguridad embebida en 10 fases: desde el descubrimiento de pines JTAG hasta la ejecución remota de código en un router doméstico basado en MIPS. | ---|--- Autor| Umber...

flopz

Flopz - 基于Python的固件解放工具 Flopz 是一个纯 Python 编写的汇编工具包。可用它来： 为嵌入式系统创建 Shellcode 动态修补大量二进制文件 对固件镜像进行插桩，用于调试和模糊测试 目前 Flopz 支持： ARM：Thumb 模式 PPC：仅 VLE RISC-V：RV32I、RV32C IA-32 如果您希望看到其他架构得到支持，欢迎随时联系我们——我们乐于从事这项工作！ Flopz 与 keystone、rasm2、gcc 等工具有何不同？ Flopz 不仅仅是将汇编字符串转换为字节，而是致力于让交互式修补和固件插桩变得更加容易。...

exfilkit

exfilkit Data exfiltration utility for testing detection capabilities Description Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server ./exfilkit-cli.py -m...

study_embedded_security

studyembeddedsecurity A hands-on study...

wolfSSL 安全漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the American company wolfSSL, aimed at developers working with embedded systems. wolfSSL has a security vulnerability that stems from an integer underflow issue during the parsing of X.509 certificates, which may le...

wolfSSL 安全漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the American company wolfSSL, aimed at developers working with embedded systems. Versions of wolfSSL prior to 5.8.4 contained a security vulnerability. This vulnerability stemmed from an integer underflow in the AEA...

EUVD-2015-8669

Malware in sbrugna...

EUVD-2015-8667

Malware in sbrugna...

EUVD-2015-8668

Malware in sbrugna...

Provable Execution in Real-Time Embedded Systems

Embedded devices are increasingly ubiquitous and vital, often supporting safety-critical functions. However, due to strict cost and energy constraints, they are typically implemented with Micro-Controller Units MCUs that lack advanced architectural security features. Within this space, recent...

Real Time Logic SharkSSL 安全漏洞

Real Time Logic SharkSSL is an embedded SSL/TLS client and server solution from Real Time Logic. A security vulnerability exists in Real Time Logic SharkSSL. An attacker could exploit this vulnerability to trigger a denial of service via a malformed Client-Hello message...

WolfSSL 安全漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in WolfSSL version 5.6.6, which can be exploited by remote attackers to disclose information and elevate privileges via a...

wolfSSL 安全漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL prior to version 5.7.2, which stems from the use of insufficiently randomized random numbers when generating...

CVE-2023-48316 Azure RTOS NetX Duo Remote Code Execution Vulnerability

Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to snmp,...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM QRadar SIEM

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 used by IBM QRadar SIEM. IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2590 DESCRIPTION: An unspecified vulnerability ...

Altran picoTCP and picoTCP-NG Buffer Error Vulnerability

Altran picoTCP is a small footprint modular open source TCP/IP stack from Altran Belgium, designed for embedded systems and the Internet of Things. A buffer error vulnerability exists in picoTCP and picoTCP-NG, which stems from the inability of the TCP input data handling function to validate the...

wolfSSL buffer overflow vulnerability (CNVD-2019-34376)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in the 'CheckCertSignatureex' function in the wolfcrypt/src/asn.c file in wolfSSL 4.1.0 and earli...

Wolfssl Local Information Disclosure Vulnerability

WolfSSL formerly known as CyaSSL is the United States WolfSSL company for embedded systems developers to use embedded SSL programming library. A local information disclosure vulnerability exists in Wolfssl's fpmulcomba function. An attacker exploiting this vulnerability could extract RSA key...

INSIDE Secure MatrixSSL Buffer Overflow Vulnerability

INSIDE Secure MatrixSSL is an embedded, open source SSLv3 stack from INSIDE Secure, France, designed for small applications and devices. A buffer overflow vulnerability exists in several versions of MatrixSSL, which can be exploited by an attacker to execute arbitrary code...