CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication

CVE-2026-22017 – BLE固件更新无需身份验证 程序代码（Python bleak 外设） root@kitploit: blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: def initself: self.firmwaredata = bytearray def...

IoT-Implant-Toolkit

IoT-Implant-Toolkit IoT-Implant-Toolkit 是一个用于物联网设备恶意软件植入研究的有用工具框架。它包含了固件修改、串口调试、软件分析和稳定间谍客户端等基本软件工具。借助易于使用且可扩展的类似 shell 的环境，IoT-Implant-Toolkit 是一个一站式工具包，简化了物联网恶意软件植入的复杂流程。 在我们的研究中，我们使用 IoT-Implant-Toolkit 成功地在八个设备中植入了木马，包括智能音箱、摄像头、行车记录仪和移动翻译器。 以下为演示视频： 如何使用 安装 确保已安装 git、python3 和 setuptools。...

CVE-2024-54085

CVE-2024-54085：AMI MegaRAC BMC 中的关键身份验证绕过漏洞 受影响系统 该漏洞影响多家主要制造商的广泛服务器硬件： AMI MegaRAC SPx ：12.x 至 12.7 版本和 13.x 至 13.5 版本 HPE Cray XD670 ：1.09、1.13、1.17 版本 Asus RS720A-E11-RS24U ：1.2.27 版本 ASRockRack ：服务器 Supermicro ：服务器 众多其他使用 AMI BMC 的领先制造商服务器 技术利用细节 漏洞位于以下文件中： root@kitploit:...

CVE-2026-85083

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-85083

CVE-2026-85083 affects the ANJIA AJL33PC0801 IP camera (CareCam Pro), which ships with a hard-coded credential used for bootloader authentication . The affected firmware is linuxlinux202008261138 svn13796 with U-Boot 2010.06 (compiled Aug 26, 2020). An attacker with physical access can exploit th...

EUVD-2026-76128

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

PT-2026-88450

🔴 CISA flags hardcoded credential flaw in CareCam Pro IP cameras deployed globally ANJIA AJL33PC0801 IP camera firmware linuxlinux202008261138 svn13796, U-Boot 2010.06 compiled Aug 26 2020 contains hardcoded bootloader credentials. An attacker with physical access can exploit CVE-2026-85083 to ga...

CVE-2026-11736

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

CVE-2026-9214

The CVE-2026-9214 entry concerns NETGEAR R7000 routers. The root cause is insufficient input validation in the affected device. Affected are authenticated administrators on the local network who can tamper with router software and functionality, leading to unauthorized modifications. No exploitat...

CVE-2026-11736 Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

CVE-2026-11735 Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...

CVE-2026-11735

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-56194

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...

CVE-2026-11835 Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

CVE-2026-11835 Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

CVE-2026-11835

Caliptra Core ROM (2.1.0–2.1.1) contains a TOCTOU vulnerability in UpdateResetFlow::run() that, with missing input validation, lets a compromised MCU firmware with AXI manager access inject an unvalidated AXI staging address. This bypasses secure boot by not validating against SS_EXTERNAL_STAGING...

CVE-2026-44104

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise...

CVE-2026-8989 Open Recovery Mode

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data...

CVE-2026-10045

Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash...

CVE-2026-10045

Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash...