CVE-2021-1982

CVE-2021-1982 concerns Qualcomm Snapdragon family devices (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile) where improper input validation of NAS OTA messages can cause a denial of service. The NVD entry shows CVSS v3.1 base score 7.5 (NETWORK, LOW attack complexity,...

CVE-2021-1981

CVE-2021-1981 involves a buffer over-read caused by an improper Bearer capability IE size check in MT setup requests from the network. It affects Qualcomm/Qualcomm closed‑source components used in Snapdragon platforms, including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT...

CVE-2021-1979

CVE-2021-1979 describes a buffer overflow in Qualcomm Snapdragon components caused by improper validation of FTM command payloads. The affected products span Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, and Mobile lines, with exploitation potentially leading to memory cor...

CVE-2021-1975

Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2021-1975

CVE-2021-1975 affects Qualcomm closed‑source components (e.g., data-modem) in Snapdragon family. Root cause: improper length check of the domain while parsing DNS responses, leading to a heap overflow. Documents indicate high/critical impact and potential remote implications in Qualcomm’s Stack; ...

CVE-2021-1973

CVE-2021-1973 concerns a vulnerability in Qualcomm Snapdragon modem software where a FTM Diag command could write arbitrarily to modem OS space. Connected sources indicate impact across multiple Snapdragon lines (Auto, Compute, Connectivity, Consumer/Industrial IoT, IoT, Mobile, Wearables, Voice ...

CVE-2021-1921

CVE-2021-1921 describes memory corruption due to improper handling of hypervisor unmap operations for concurrent memory operations in Qualcomm Snapdragon families (Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile). Connected sources confirm this vulnerability across Qualcomm closed‑so...

CVE-2021-1912

The CVE-2021-1912 issue concerns Qualcomm Snapdragon firmware across Snapdragon Auto, Compute, Connectivity, Industrial IOT and Mobile families. A root cause is an integer overflow caused by an improper length check when computing count and grace period. Affected components are within the Snapdra...

Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 4

The first 3 installments of our series on Rapid7's hands-on exercise from the IoT Village at this year's DefCon covered how to set up a UART header, how to determine UART status and baud rate, and how to log into single-user mode on the device. In this final post, we'll discuss how to gain full...

Realtek RTL8195AM 缓冲区错误漏洞

The Realtek RTL8195AM is an IoT microcontroller from Realtek Semiconductor Realtek of Taiwan, China. A buffer error vulnerability exists in Realtek RTL8195AM versions prior to 2.0.10, which stems from a buffer overflow vulnerability in the incorrect IE length of the device's processing of HT...

14 security vulnerabilities reported in BusyBox Linux utility

By Deeba Ahmed For your information, BusyBox is generally used by embedded devices like IoT products or ICS industrial control systems. This is a post from HackRead.com Read the original post: 14 security vulnerabilities reported in BusyBox Linux utility...

13 New Flaws in Siemens Nucleus TCP/IP Stack Impact Safety-Critical Equipment

As many as 13 security vulnerabilities have been discovered in the Nucleus TCP/IP stack, a software library now maintained by Siemens and used in three billion operational technology and IoT devices that could allow for remote code execution, denial-of-service DoS, and information leak...

Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton

By Claudio Bozzato and Lilith --;. Following our previous engagements see blog posts 1, 2, 3 and 4 with Microsoft's Azure Sphere IoT platform, we decided to take another look at the device, without all the rush and commotion that normally entails a hacking challenge. Today, we’re... This is only...

Microsoft Azure Sphere Kernel GPIO_GET_PIN_ACCESS_CONTROL_USER information disclosure vulnerability

Talos Vulnerability Report TALOS-2021-1340 Microsoft Azure Sphere Kernel GPIOGETPINACCESSCONTROLUSER information disclosure vulnerability November 9, 2021 CVE Number None SUMMARY An information disclosure vulnerability exists in the GPIOGETPINACCESSCONTROLUSER functionality of Microsoft Azure...

Learn how Microsoft strengthens IoT and OT security with Zero Trust

As cyber threats grow more sophisticated and relentless, the need for Cybersecurity Awareness Month becomes more urgent every year. As part of our year-round commitment to security for all, Microsoft continues to track numerous incidents targeting both digital and physical operations for many...

Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 3

In our first post in this series, we covered the setup of Rapid7's hands-on exercise at Defcon 29's IoT Village. Last week, we discussed how to determine the UART status of the header we created and how to actually start hacking on the IoT device. The goal in this next phase of the IoT hacking...

How Microsoft Defender for IoT can secure your IoT devices

Cybersecurity threats are always evolving, and today we’re seeing a new wave of advanced attacks specifically targeting IoT devices used in enterprise environments as well as operational technology OT devices used in industrial systems and critical infrastructure like ICS/SCADA. It’s not surprisi...

How Microsoft Defender for IoT can secure your IoT devices

Cybersecurity threats are always evolving, and today we’re seeing a new wave of advanced attacks specifically targeting IoT devices used in enterprise environments as well as operational technology OT devices used in industrial systems and critical infrastructure like ICS/SCADA. It’s not surprisi...

Do Home Hackers Compromise Business Security?

The most recent Pwn2Own Fall 2021 Pwn2Own Austin includes more IoT entries than ever. This gives us an opportunity to probe today’s largest and newest enterprise attack surface: the home office...

Does Home IoT Compromise Enterprise Security?

The most recent Pwn2Own Fall 2021 Pwn2Own Austin includes more IoT entries than ever. This gives us an opportunity to probe today’s largest and newest enterprise attack surface: the home office...