CVE-2017-7911: Improper Control of Generation of Code

A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-encapsulation vulnerability has been identified, which may allow remote code execution...

CVE-2017-7911

A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-encapsulation vulnerability has been identified, which may allow remote code execution...

PT-2017-17988

Name of the Vulnerable Software and Affected Versions CyberVision Kaa IoT Platform version 0.7.4 Description A Code Injection issue was discovered, which is related to an insufficient-encapsulation vulnerability. This may allow remote code execution. Recommendations For CyberVision Kaa IoT Platfo...

CVE-2017-7911

The CVE-2017-7911 issue affects CyberVision Kaa IoT Platform v0.7.4 (and possibly other versions). It is described as an insufficient encapsulation (CWE-485) vulnerability that enables remote code execution via code injection in the affected middleware. Public descriptions consistently attribute ...

Glaring Vulnerabilities Make Many Commercial Drones 'Insecure by Design'

Drones, many readily available on ecommerce shops such as Amazon, are plagued by vulnerabilities that could give attackers full root access to the device, read or delete files, or crash the device. The United States Computer Emergency Readiness Team US-CERT published a warning about one model, th...

Kaa IoT Administration Server Detection

Binary data kaaiotdetect.nbin...

WolfSSL library X509 Certificate Text Parsing Code Execution Vulnerability

Summary An exploitable off-by-one write vulnerability exists in the x509 certificate parsing functionality of wolfSSL library versions up to 3.10.2. A specially crafted x509 certificate can cause a single out of bounds byte overwrite resulting in potential certificate validation vulnerabilities,...

CyberVision Kaa IoT Platform

CVSS v3 6.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: CyberVision Equipment: Kaa IoT Platform Vulnerability: Code Injection AFFECTED PRODUCTS The following version of Kaa IoT Platform, a middleware platform, is affected: Kaa IoT Platform, Version 0.7.4, and possibly othe...

StringBleed: SNMP Protocol“God mode”vulnerability affects a variety of network devices-vulnerability warning-the black bar safety net

Recently, data from South America, two security researchers discovered that the SNMP（Simple Network Management Protocol the v1 and v2 version of the Protocol the presence of the authorized authentication and access control bypass vulnerability, at least 78 kinds of models of network access and Io...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

The Time Has Arrived to Embrace Hackers

BOSTON—More than ever, hackers are getting a welcoming embrace from law enforcement, governments and business. Bug bounties and vulnerability disclosure programs are becoming the norm across industry, and hackers are no longer universally viewed as a pariah. Simultaneously, however, groups such a...

SNMP Incorrect Access Control Vulnerability (CVE 2017-5135) (StringBleed)

In DEFCON 24 IoT Village i gave a talk about the danger of SNMP write properties enabled devices in the IoT, police patrols, ambulances and other in the “critical mission vehicles” were affected in that research. In December 2016 with a colleague from Argentina Ezequiel Fernandez we decided to...

Hajime ‘Vigilante Botnet’ Growing Rapidly; Hijacks 300,000 IoT Devices Worldwide

Last week, we reported about a so-called 'vigilante hacker' who hacked into at least 10,000 vulnerable 'Internet of Things' devices, such as home routers and Internet-connected cameras, using a botnet malware in order to supposedly secure them. Now, that vigilante hacker has already trapped rough...

Mirai and Hajime Locked Into IoT Botnet Battle

Security experts say a white hat hacker is responsible for the Hajime IoT botnet, which is on a mission to secure IoT devices vulnerable to the notorious Mirai malware. Divergent goals between Mirai and Hajime, experts say, will spark a perpetual back-and-forth between Mirai black hats and a lone...

The 'Audience of You' at NAB

It's all about the "audience of you" as Akamai gears up for next week's 2017 NAB Show in Las Vegas. With that phrase, we're talking about helping to deliver the best possible experiences for each and every OTT video viewer. It's not an easy thing to do, but we're demonstrating a host of new...

4 ways mobile devices still threaten your business

Mobile devices have been commonly used in corporate environments for decades - bulky portable telephones, heavy laptops and PDAs. Then along came Apple and the smartphone, and soon everyone either had personal smartphone or expected their employers to provide one. Since then, enterprise mobility...

Rapid7 urges NIST and NTIA to promote coordinated disclosure processes

Rapid7 has long been a champion of coordinated vulnerability disclosure and handling processes as they play a critical role in both strengthening risk management practices and protecting security researchers. We not only use coordinated disclosure processes in our own vulnerability disclosure and...

To Protect Your Devices, A Hacker Wants to Hack You Before Someone Else Does

It should be noted that hacking a system for unauthorised access that does not belong to you is an illegal practice, no matter what's the actual intention behind it. Now I am pointing out this because reportedly someone, who has been labeled as a 'vigilante hacker' by media, is hacking into...

Bosch automotive Drivelog Connector dongle remote vulnerability analysis-vulnerability warning-the black bar safety net

In this article, we will be on the Argus research team at Bosch Drivelog Connect BOD-II adapter in the discovery of the vulnerability is discussed in detail. Note that this vulnerability would allow an attacker to by Drivelog platform to stop a running car engine. According to the Argus of the...

On Baseband Vulnerabilities, SIEMs, Samsung Tizen and More

Mike Mimoso, Tom Spring, and Chris Brook recap two conferences from last week: Infiltrate Con in Miami and Kaspersky Lab’s Security Analyst Summit in St. Maarten. A baseband vulnerability, SIEMs, vulnerabilities in Samsung’s Tizen operating system, and an IoT honeypot are discussed. Download:...