fwbt

fwbt Writeup: https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/ Proof of Concept code for interaction with Firewalla via Bluetooth Low-Energy and exploitation of CVE-2024-40892 / CVE-2024-40893 Without any configuration it will scan for Firewalla's in local proximity and leak th...

knob

README Repository about the Key Negotiation Of Bluetooth KNOB attacks on Bluetooth BR/EDR and Bluetooth Low Energy. Related Work From the Bluetooth Standard to Standard-Compliant 0-days HWIO20 Key Negotiation Downgrade Attacks on Bluetooth and Bluetooth Low Energy TOPS20 Bluetooth blues: KNOB...

routersploit

RouterSploit - Exploitation Framework for Embedded Devices Community Join community on Embedded Exploitation Discord. Description The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aid penetration testing...

btlejack

BtleJack: a new Bluetooth Low Energy swiss-army knife Btlejack provides everything you need to sniff, jam and hijack Bluetooth Low Energy devices. It relies on one or more BBC Micro:Bit . devices running a dedicated firmware. You may also want to use anAdafruit's Bluefruit LE sniffer or a nRF5182...

ble_proxy

BLE HTTP Proxy System A Bluetooth Low Energy BLE based HTTP proxy system that routes web browser traffic through an iOS device. This allows web browsing through the iOS device's internet connection using BLE as the transport layer. Architecture Overview Browser → Windows Proxy → BLE/TCP → iOS/Moc...

AI and the Automobile

Open Arsenal AI and the Autombile Specifications The AI and the Automobile collection brings together multiple specifications that define how AI integrates into modern vehicle systems. Across the set, it treats the automobile as a software-defined platform where intelligence is distributed across...

BlueBunny

C2 solution that communicates directly over Bluetooth-Low-Energy with your Bash Bunny Mark II. Send your Bash Bunny all the instructions it needs just over the air. Table of contents Overview Installation & Start Manual communication with the Bash Bunny through Python Troubleshooting Working on...

ble_norton_core

PoC command injection in BLE service of Norton Core Secure WiFi Router CVE-2018-5234 For more information read paper. To demonstrate the exploitation, we will use: OS GNU/Linux; Bluetooth dongle adapter; BlueZ utility for testing Bluetooth connection. In order to use the script, we will need to s...

BTLE

BTLE BTLE is a free and open-source Bluetooth Low Energy BLE Software Defined Radio software suite and open BTLE chip design. It includes: BTLE baseband algorithms description, Python and Verilog implementation, FPGA and SkyWater 130 PDK OpenLane2 workflow results. Analog Devices AD9361 + Xilinx...

CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication

CVE-2026-22017 – Firmware Update via BLE Without Authentication Program Code Python bleak peripheral blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: def initself: self.firmwareda...

CVE-2026-8065

CVE-2026-8065 — Hitachi Energy RTU500 unauthenticated firmware update Python 3 PoC for CVE-2026-8065 — Hitachi Energy RTU500 Series CMU Firmware — authentication bypass CWE-306 on the firmware update HTTP endpoint. CVSS 3.1 9.1 Critical IoT/OT. | ---|--- PoCbit|...

sweyntooth_bluetooth_low_energy_attacks

SweynTooth - Unleashing Mayhem over Bluetooth Low Energy This repository is part of a research outcome from theASSET Research Group. SweynTooth captures a family of 18 vulnerabilities across different Bluetooth Low Energy BLE software development kits SDKs of six major system-on-a-chip SoC vendor...

BLE-Replay

BLE-Replay BLE-Replay is a Bluetooth Low Energy BLE peripheral assessment tool. It pulls/consumes Bluetooth HCI logs from your mobile device and extracts all of the writes that the central makes to a peripheral. This data can be replayed using most Bluetooth dongles from a Linux host, or saved to...

UniBLEed

UniBLEed Unitree G1 RCE PoC & Scripts CVE-2026-76639 / CVE-2026-76640 technical details at boschko.ca/g1-ble-rce/ Use this repository only with robots, accounts, and networks you are authorized to test. The active chains can change the robot's WiFi configuration, stop or restart services, crash...

smart-sketcher-upload

smART Sketcher 2.0 - Bluetooth Authentication Bypass CVE-2026-0842 | Missing Authentication on BLE Interface Overview The smART Sketcher 2.0 is a Bluetooth-enabled toy projector that lets kids trace images. It has no authentication on its Bluetooth connection - anyone within range can connect and...

UniPwn

Unitree Robot BLE Service Command Injection Analysis Author: Bin4ry aka Andreas Makris [email protected] Co-Author: h0stile aka Kevin Finisterre Contributor: legion1581 aka Konstantin Severov from theroboverse helped to fix the payload for the injection and proved it with a fully working PoC...

ble-cve2025-attack-new-version

ble-cve2025-attack-new-version android-ble-cve-2025-4866 🔐 PoC for CVE-2025-4866 — Android BLE Vulnerability public version 📡 Exploitation of BLE authorization weakness on Android devices public PoC only. 👨💻 Developed by BloodCode Labs — 2025...

om-research

OM Research This repository explores the Bluetooth Low Energy BLE protocol used by the Osmo Mobile series of gimbals. The official mobile apps are outdated and require broad system permissions. However, the gimbals themselves communicate through a simple BLE protocol. The goal of this project is ...

shining-mask

Shining Mask Hacks This repository contains code and instructions for creating a custom Bluetooth Low Energy BLE controller for the Shining LED Mask that automatically changes the face image of any masks within BLE range. This repository is a companion to Invasion of the Facechangers: Halloween...

CVE-2025-7769

CVE-2025-7769 – Remote Command Injection in mobileapi Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑7769 , a critical remote Command Injection vulnerability found in Tigo Energy CCA appliances exposing the /cgi-bin/mobileapi endpoint. The vulnerability is...