CVE-2023-33974 RIOT-OS vulnerable to Race Condition in SFR Timeout

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions...

CVE-2023-33973

RIOT-OS contains a flaw in its 6LoWPAN processing within the GNRC network stack. In versions 2023.01 and prior, an attacker can send a crafted frame that is forwarded by the device; during encoding of the packet a NULL pointer dereference occurs, crashing the device and causing a denial of servic...

CVE-2023-24817

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer...

CVE-2023-24825

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixe...

CVE-2023-24826

CVE-2023-24826 affects RIOT-OS on IoT devices with its 6LoWPAN-capable network stack. Before version 2023.04, an attacker can send crafted frames that trigger the use of an uninitialized object, causing a denial of service. The issue is fixed in version 2023.04. A workaround is to disable fragmen...

CVE-2023-24825 RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixe...

CVE-2023-24825

RIOT-OS’s 6LoWPAN frame handling in the GNRC network stack is vulnerable to a NULL pointer dereference when processing crafted frames. This affects versions prior to 2023.04 and can lead to denial of service. The issue is fixed in version 2023.04; there are no known workarounds. Upgrade to 2023.0...

CVE-2023-24825 RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixe...

CVE-2023-24817 RIOT-OS vulnerable to Out of Bounds write in routing with SRH

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer...

CVE-2023-24817 RIOT-OS vulnerable to Out of Bounds write in routing with SRH

RIOT-OS, an operating system for Internet of Things IoT devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer...

CVE-2023-24817

CVE-2023-24817 affects RIOT-OS, specifically the 6LoWPAN processing in its network stack. A crafted 6LoWPAN frame sent to affected devices prior to version 2023.04 can trigger an integer underflow and out-of-bounds access in the packet buffer, potentially corrupting other packets or allocator met...

All your building are belong to us

TL;DR Building Management Systems BMS bring new risks to businesses that havent had previous experience of securing Operational Technology OT While there might not be direct financial gain from hacking BMS, these systems can be a soft target for attackers to pivot into your business operations. I...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages,...

Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

An overview of the Lemon Group’s use of preinfected mobile devices, and how this scheme is potentially being developed and expanded to other internet of things IoT devices. This research was presented in full at the Black Hat Asia 2023 Conference in Singapore in May 2023...

Advantech EKI-15XX Series Command Injection / Buffer Overflow

CyberDanube Security Research 20230511-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| EKI-1524-CE series, EKI-1522 series, EKI-1521 series vulnerable version| 1.21 fixed version| 1.24 CVE number| CVE-2023-2573,...

Andoryu Botnet Exploits Critical Ruckus Wireless Flaw for Widespread Attack

A nascent botnet called Andoryu has been found to exploit a now-patched critical security flaw in the Ruckus Wireless Admin panel to break into vulnerable devices. The flaw, tracked as CVE-2023-25717 CVSS score: 9.8, stems from improper handling of HTTP requests, leading to unauthenticated remote...

Siemens SIMATIC Cloud Connect 7 Path Traversal Vulnerability

SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices with OPC UA server interfaces to be connected as OPC UA clients. A path traversal vulnerability exists in Siemens SIMATIC Cloud Connect 7, which can be exploited by a...

Siemens SIMATIC Cloud Connect 7 Information Disclosure Vulnerability (CNVD-2023-35769)

SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices with OPC UA server interfaces to be connected as OPC UA clients. An information disclosure vulnerability exists in Siemens SIMATIC Cloud Connect 7, which can be...

Siemens SIMATIC Cloud Connect 7 Path Traversal Vulnerability (CNVD-2023-35768)

SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices with OPC UA server interfaces to be connected as OPC UA clients. A path traversal vulnerability exists in Siemens SIMATIC Cloud Connect 7, which can be exploited by a...

Siemens SIMATIC Cloud Connect 7 Denial of Service Vulnerability

SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices with OPC UA server interfaces to be connected as OPC UA clients. A denial of service vulnerability exists in Siemens SIMATIC Cloud Connect 7, which can be exploited b...