CVE-2025-66678

CVE-2025-66678 在 Hardware Read & Write Utility v1.25.11.26 中，驱动程序通过 MmMapIoSpace 暴露了任意的 MSR 读写以及物理内存读写，两者均可实现内核代码执行。 PoC 详情 该 PoC 将通过交换当前进程的主令牌，使其成为 NT Authority\SYSTEM。 使用方法 1. 将易受攻击的驱动程序放置在 C:\Users\Public 目录下 2. 以管理员身份运行漏洞利用程序 注意：本项目中不会共享该易受攻击的驱动程序。 示例输出 读写 MSR 读写物理内存 免责声明...

gdbfuzz

GDBFuzz: Debugger-Driven Fuzzing This is the companion code for the paper: 'Fuzzing Embedded Systems using Debugger Interfaces'. A preprint of the paper can be found here https://publications.cispa.saarland/3950/. The code allows the users to reproduce and extend the results reported in the paper...

gdbfuzz

GDBFuzz: デバッガ駆動ファジング これは論文「Fuzzing Embedded Systems using Debugger Interfaces」の付属コードです。 論文のプレプリントはこちら https://publications.cispa.saarland/3950/ から入手できます。このコードにより、ユーザーは論文で報告された結果を再現し、拡張することができます。 結果を報告、再現、拡張する際には、上記の論文を引用してください。 フォルダ構造 . ├── benchmark Googleのファザーテストスイートをビルドし、実験を実行するスクリプト ├──...

dcsgonebadge

DEF CON シンガポール ワンバッジ このプロジェクトは、Circuit Crafters の最初のプロジェクトである電子ハードウェアバッジのハードウェア設計を管理します。このバッジは、マリーナベイサンズ エキスポ＆コンベンションセンターで開催される DEF CON Singapore 2026 セキュリティカンファレンスで配布される予定です。 ライセンス このプロジェクトは、CERN Open Hardware Licence Version 2 - Strongly Reciprocal CERN-OHL-S. の下でライセンスされています。あなたは CERN-OHL-S...

Reversing the Clock: Layout-Aware Recovery of Design Intent from Clock Distribution Networks

Hardware reverse engineering supports competitive analysis and hardware assurance by recovering information about an integrated circuit IC from its physical implementation. While existing techniques primarily recover the gate-level netlist, which represents logical functionality, they often...

erica

Erica 面向 315/433/868/915MHz 频段的 GreatFET One 邻居板卡。这个邻居板卡并非来自 GreatScottGadgets 的设计。所以如果它不能正常工作，不要责怪 GSG，要怪我。 名称 欧石楠（erica）这种植物的枝条让我有些联想到天线。而这正是 Erica 的意义所在——一个带有 4 根天线的邻居板卡。 目的 这个邻居板卡的主要目的是在 315MHz/433MHz/868MHz/915MHz 频段内提供开展安全研究的可能性。思路是总共提供 4 个 CC1101 收发器。一个调谐到 315MHz 频段，一个调谐到 433MHz 频段，两个用于...

awind-research

Awind 研究 本仓库收录了与我所开展的研究相关的各类有用资料，该研究针对 Awindinc 制造并贴牌（OEM）给多家厂商的无线演示设备。 该仓库分为以下几个子部分： hardware - 硬件破解相关内容，主要用于 MMC 转储和引脚定义文档 networking - PIN 码暴力破解器、自定义 Nmap 脚本和指纹 exploits - Metasploit 模块和基于 Python 的漏洞利用程序。 受影响设备 以下设备均由 Awind 贴牌生产，因此受相同问题影响。 Crestron Airmedia AM-100 Crestron Airmedia AM-101...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

EUVD-2026-90658

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264

Fleet versions before 4.87.0 are vulnerable to an authentication bypass in the device API. The root cause is that the API accepts hostnames and hardware serials as authentication tokens alongside device UUIDs. Unauthenticated attackers capable of guessing these non-secret identifiers can authenti...

CITADEL: CWE-Guided Insertion of Hardware Trojans Via Analysis of DFG-Enabled LLMs

The increasing sophistication of Hardware Trojans HTs and system-level vulnerabilities poses significant risks to modern integrated circuits. However, constructing realistic HT scenarios, remains a substantial burden: researchers must manually analyze complex RTL structures, identify plausible...

CVE-2026-103264: Improper Authentication

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 6 : kernel (RHSA-2026:73732)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73732 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: ebtables SNAT target writes...

CVE-2026-97599

A flaw was found in the Linux kernel's IEEE 802.15.4 hardware simulator driver. A lack of proper locking allows concurrent channel updates to race against each other when modifying simulated device configuration parameters. A local user could exploit this flaw to cause a double-free memory...

CVE-2026-97502

A flaw was found in the Linux kernel's DaVinci MultiMediaCard MMC driver. When processing hardware interrupt events such as read timeouts or communication errors, the driver accesses a data pointer without verifying that an active transfer structure exists. A local user or abnormal device conditi...

CVE-2026-97538

A flaw was found in the Linux kernel's ASUS ROG RYUJIN hardware monitoring driver. The driver fails to validate the length of incoming Human Interface Device HID reports before parsing response headers and data fields. An attacker capable of supplying truncated HID reports can cause the driver to...

CVE-2026-98001

A flaw was found in the Linux kernel's LTC4282 hardware monitoring driver. This vulnerability can lead to a Denial of Service DoS due to the use of uninitialized stack memory. The driver fails to initialize its clock data structure during setup, leaving member fields uninitialized. A local attack...