229 matches found
CVE-2019-13991
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs directly connected to GPIO pins via a laser, because of LED photosensitivity...
Code injection
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs directly connected to GPIO pins via a laser, because of LED photosensitivity...
CVE-2019-13991
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs directly connected to GPIO pins via a laser, because of LED photosensitivity...
CVE-2019-13991
CVE-2019-13991 affects embedded Arduino-based systems before Rev3, where a remote attacker can send data to LEDs connected directly to GPIO pins via a laser due to LED photosensitivity. The connected records consistently describe the vulnerability as a remote-access data delivery path to on-board...
MiniUPnP MiniUPnPd Denial of Service Vulnerability
MiniUPnP is a UPnP tool that can be used for embedded systems. MiniUPnP A denial of service detail exists in MiniUPnPd. The vulnerability stems from improper design or implementation during code development of a networked system or product. An attacker can exploit the vulnerability to launch a...
Nvidia Fixes 8 High-Severity Flaws Allowing DoS, Code Execution
Nvidia has released fixes for eight high-severity vulnerabilities in its Linux for Tegra driver packages. The worst of these flaws could allow information disclosure, denial of service and code execution on impacted systems. Overall, the chipmaker on Tuesday released patches for 13 flaws that...
Preparing for Y2038 (Already?!)
It somehow doesn't seem that long ago, but nineteen years ago during Y2K I spent my New Year's Eve in the Akamai Network Operations center, waiting to respond to anything that might go awry as the clock struck midnight in key time zones such as Greenwich and Boston. As of January 9, 2019, we are...
HASSH - A Network Fingerprinting Standard Which Can Be Used To Identify Specific Client And Server SSH Implementations
"HASSH" is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint. What can HASSH help with: Use in highly controlled, well understood environments...
Critical Flaws Found in Amazon FreeRTOS IoT Operating System
A security researcher has discovered several critical vulnerabilities in one of the most popular embedded real-time operating systems—called FreeRTOS—and its other variants, exposing a wide range of IoT devices and critical infrastructure systems to hackers. What is FreeRTOS Amazon, WHIS OpenRTOS...
Unspecified Vulnerability in Oracle Java SE and Java SE Embedded (CNVD-2019-26735)
Oracle Java SE is the standard version of Oracle's Java platform for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments, and Java SE and Java SE Embedded are components of Java SE Embedded, a Java platform for developing powerful,...
Wind River VxWorks Vulnerabilities
Overview A security researcher has identified two vulnerabilities affecting the Wind River Systems’ VxWorks platform. The vulnerabilities are a debug service enabled by default VU362332 and a weak hashing algorithm used in authentication VU840249. ICS-CERT has been coordinating with CERT/CC in...
Modern OSs for embedded systems
At Kaspersky Lab we analyze the technologies available on cybersecurity market and this time we decided to look at what OS developers are offering for embedded systems or, in other words, the internet of things. Our primary interest is how and to what degree these OSs can solve...
PolarSSL: Multiple vulnerabilities
Background PolarSSL is a cryptographic library for embedded systems. Description Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. Impact A remote attacker might be able to execute arbitrary code, cause Denial of Service...
picoTCP Stack Buffer Overflow Vulnerability
picoTCP is a modular open source TCP/IP stack designed for embedded systems and IoT. A stack buffer overflow vulnerability exists in picoTCP versions 1.7.0 through 1.5.0. A remote attacker could exploit this vulnerability to execute code or cause a denial of service...
Kaspersky Embedded Systems Security Buffer Overflow Vulnerability
Kaspersky Embedded Systems Security is a security protection software for embedded systems developed by the Russian Kaspersky Lab. A buffer overflow vulnerability exists in the driver in Kaspersky Embedded Systems Security versions 1.2.0.300 and 2.0.0.385. The vulnerability can be exploited by an...
CVE-2017-12823
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
Memory corruption
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
CVE-2017-12823
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
CVE-2017-12823
CVE-2017-12823 affects Kaspersky Embedded Systems Security (ESES); a kernel pool memory corruption in a driver leads to local privilege escalation. Connected sources indicate vulnerable versions include 1.2.0.300 (and 2.0.0.385 per CNVD). The root cause is memory corruption/buffer overflow in the...