RE11S_1.11-formAccept-CommandInjection

RE11S1.11-formAccept-CommandInjection 在奇安信天工实验室实习期间，我在 RE11S1.11 路由器中发现了一个命令注入漏洞。 通过分析 bin 目录下的 webs 文件，我发现 formAccept 函数中包含一个命令注入漏洞。 该命令注入可通过 submit-url 键值触发，从而造成系统命令注入。 如何仿真路由器 使用以下命令通过 firmAE 进行仿真。 root@kitploit: sudo ./run.sh -r v1 /IOT/RE11S1.11/RE11S1.11.bin poc.py 文件的内容如下： root@kitploit:...

blackbox-fuzzing

物联网设备黑盒模糊测试——以路由器 TL-WR902AC 为例 这是我的学期论文的 HTML 版本，可在此处下载 PDF 此处。 引言 模糊测试已成为发现软件漏洞的“最有效方法之一”。许多当前与模糊测试相关的论文都以这种或类似的论断开篇 google-scholar。 我们上一篇关于“易受攻击的物联网”主题的学期论文的主要目标是找到一个内存相关漏洞，然后为这个漏洞编写利用程序。我们通过逆向固件成功找到了一个漏洞，但没有发现内存相关的漏洞。手动逆向二进制文件来发现缓冲区溢出不仅耗时，而且需要大量经验。与此同时，模糊测试正是为了成为发现此类内存相关漏洞的“最有效方式”。例如，谷歌推出了...

IoT_vuln

TOTOLINK设备的POC： TOTOLINK LR350：CVE-2024-10654（登录绕过） TOTOLINK T6：CVE-2025-6916（登录绕过）- 要深入了解此CVE，请阅读更多内容：https://anduinbrian.github.io/posts/blogs/totolink-t6-v3/...

CVE-2021-27289

🐝 CVE-2021-27289: Bypass de Protección de Reproducción en dispositivos Zigbee Ksix 📑 Índice Antes de empezar La historia detrás de este CVE Vulnerabilidad Dispositivos afectados Detalles técnicos Escenario de ataque Impacto Prueba de concepto Vídeos de demostración Publicación original del blog...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

LB-LINK Routers - Unauthenticated Command Injection

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...

CVE-2022-4096

CVE 2022 -4096 Amine TITROFINE | 21 de enero de 2023 Este experimento está destinado a demostrar cómo funciona el ataque de DNS rebinding en un IoT emulado. En la configuración, tenemos un dispositivo IoT simulado, que puede ser controlado a través de una interfaz web esto es típico para muchos...

CVE-2025-27840-WIP

CVE-2025-27840-WIP 针对 CVE-2025-27840 的进行中工作 CVE-2025-27840 概述 CVE-2025-27840 是一个中等级别漏洞（CVSS 6.8 ），影响乐鑫 ESP32 蓝牙芯片 ，该芯片已集成到全球超过 10 亿台物联网设备中。该缺陷涉及 29 条未记录的控制器接口（HCI）命令 ，可能实现未经授权的内存访问和设备控制。 🔧 关键技术细节 影响 ESP32 固件版本 2025-03-06 关键命令0xFC02 允许直接写入内存 利用该漏洞需要物理访问权限或特权权限 ⚠️ 潜在风险 设备伪造和未经授权的数据访问 网络横向渗透和持续性威胁...

mud-visualizer

メーカー使用状況記述 MUD ビジュアライザー 警告: mud-visualizer は現在ベータ版です。自己責任でご利用ください。 このツールは、MUDファイルをJSON形式で可視化するために使用できます。 目次 動機 インストール サポートされているMUD抽象化 貢献 サポート 引用 ライセンス 動機...

CVE-2026-77966 Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

MINI-RG49-H5RP-JFGR

Bulletin has no description...

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham an...

PT-2026-73233

damn so check this out... basically some crazy smart researchers found out that a bad SIM card can straight up hijack IoT devices like EV chargers and industrial routers using this sneaky old command called RUN AT. if an attacker gets physical access to stick a malicious card in there, it gives...

Exploit for CVE-2026-38422

CVE-2026-38422: Remote Code Execution via Combined Buffer Over...

vulnerability-research

Vulnerability Research & Responsible Disclosure Shivam Paji...

SenseLive X3050 跨站请求伪造漏洞

The SenseLive X3050 is a data collection and environmental monitoring device designed for IoT scenarios by SenseLive Corporation. The SenseLive X3050 has a cross-site request forgeing vulnerability. This vulnerability arises from the lack of protection against cross-site request forgeing in the w...

CVE-2022-42054

Multiple stored cross-site scripting XSS vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Company Name and Description text fields...

CVE-2022-42055

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

CVE-2021-22547

In IoT Devices SDK, there is an implementation of calloc that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading th...

CVE-2025-66647 RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first...