6045 matches found
iot-vuln-lab-cve-2017-17761
iot-vuln-lab-cve-2017-17761 基于CVE-2017-17761的IoT设备漏洞利用教育模拟...
CVE-2025-48466
CVE-2025-48466 Advantech WISE 4060LAN / ドア制御用IoTゲートウェイにおけるModbusパケットインジェクション（スクリプト: main.py を参照） 概要 ネットワーク上のドア制御用IoTゲートウェイで動作しているModbusサーバーを何らかの方法で操作するのは非常に簡単であることがわかりました。リモートの攻撃者は、WISE-4060/LANの管理パネルにアクセスすることなく、スクリプトを実行してWISE-4060/LAN 4チャンネルデジタル入力/4チャンネルリレー出力 IoT Ethernet...
CVE-2023-33869-RCE-PoC
エネルギーセキュリティ・信頼性センター - UNCシャーロット校 CVE-2023-33869 は、Enphase Envoy ファームウェア バージョン D7.0.88 に影響を与えるコマンドインジェクションの脆弱性です。この脆弱性により、攻撃者は影響を受けるデバイス上でルート権限を持つ任意のコマンドを注入し、実行することができます。Enphase Envoy は、住宅用および商業用の太陽エネルギーシステムで広く導入されている太陽光マイクロインバーターゲートウェイデバイスであり、この脆弱性は重要インフラや IoT 環境にとって特に懸念されます。...
CVE-2020-12124
IoTエクスプロイトの構造：ハンズオンからRCEまで 原文はこちら：https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce 執筆者：David E. Baker、公開日：2023年6月1日 はじめに この調査は、2020年6月時点のWavlink Wireless-AC1200...
CVE-2025-45512
U-Boot 1.1.3 Exploit PoC 使用ガイド はじめに この概念実証 PoC は、2019年8月27日にコンパイルされたU-Bootブートローダーバージョン1.1.3の脆弱性を検証するために作成されました。このコードは、OWASP IoTセキュリティテストガイド ISTG カテゴリに関連する5つの異なる脆弱性を実装しています。 警告: このPoCは、テストの許可を得たデバイスでのみ使用してください。許可なくシステムで使用すると、適用法令に違反する可能性があります。 必要条件 1. Python 3.6+ 2. シリアルインターフェース UART...
Advisories
安全公告 本仓库包含在渗透测试期间发现并报告的多个漏洞。 本仓库中的所有内容仅供教育用途。 链接 https://www.securityweek.com/organizations-notified-of-remotely-exploitable-vulnerabilities-in-aveva-hmi-scada-products/ https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02 https://www.us-cert.gov/ics/advisories/ICSA-17-138-01...
CVE-2026-96613
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...
CVE-2026-101104
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...
CVE-2026-96613
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw (CWE-862) that allows authenticated users to access the complete device shadow of any device by specifying its device ID . The service fails to verify a relationship between the requester and the target device, le...
EUVD-2026-91750
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...
CVE-2026-96613 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...
CVE-2026-96613 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...
CVE-2026-101104 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...
CVE-2026-101104
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate configurations of devices they do not own. By exploiting this flaw, an attacker can alter device settings, trigger unintended behaviors, or access sensitive informatio...
EUVD-2026-91746
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...
CVE-2026-101104 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...
CVE-2026-101104: Missing Authorization
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...
CVE-2026-96613: Missing Authorization
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...
Meari IoT Cloud Platform OpenAPI Service
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. 2. RECOMMENDED...
PT-2026-104070
Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to access the complete device shadow of any device. By specifying a device...