CVE-2020-11194

CVE-2020-11194 affects Qualcomm Snapdragon platforms (Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wired Infrastructure and Networking). The issue is a possible out-of-bounds access in the Trust Authority (TA) when processing a command received from the Network Subsyste...

CVE-2020-11177

CVE-2020-11177 affects Qualcomm closed‑source components in Snapdragon devices (Auto/Compute/Connectivity/IOT/Wearables, etc.). The issue arises from improper validation of the SPC code setting and device lock, allowing a local attacker to overwrite the Security Code NV item without current SPC b...

CVE-2020-11170

CVE-2020-11170 involves an out-of-bounds memory access during Vorbis audio playback due to improper header extraction checks in Qualcomm/ Snapdragon components (Auto, Compute, Connectivity, IOT, Mobile, etc.). Root cause: insufficient validation in header parsing leads to memory access beyond bou...

CVE-2020-11147

CVE-2020-11147 affects Snapdragon Compute, Snapdragon Industrial IOT, and Snapdragon Mobile: a use-after-free in audio modules caused by incorrect macro usage during list iteration when removing/freeing objects. Root cause is the macro misuse leading to freeing objects while iterating. Documented...

CVE-2020-11147

Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of macro in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile...

SQL Injection Vulnerability in Great Intelligence Fire Protection Digital Monitoring Center Platform

Great Wisdom Fire Digital Monitoring Center Platform is a fire IOT remote monitoring system, which is applicable to the smart fire platform under the new smart city, suitable for city networking, industry networking, large enterprise networking and remote unattended places. There is a SQL injecti...

The Most Commonly Hacked Smart Home Tech

By Waqas There are over 7 billion IoT devices and a big number is vulnerable to cyber-attacks. Here are the most commonly hacked smart home tech. This is a post from HackRead.com Read the original post: The Most Commonly Hacked Smart Home Tech...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)

In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s now owned by Tesla rebranded ConnectPort X2e device...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part Two)

In this post, we continue our analysis of the SolarCity ConnectPort X2e Zigbee device referred to throughout as X2e device. In Part One, we discussed the X2e at a high level, performed initial network-based attacks, then discussed the hardware techniques used to gain a remote shell on the X2e...

Afternoon Cyber Tea: Evaluating individual and organizational cyber risk in a pandemic

Cybersecurity professionals find themselves in high demand as organizations worldwide continue to grapple with how to secure millions of remote workers. James Turner is an industry analyst at CISO Lens and served as an adjudicator from 2017 to 2019 for the Australian government’s cyber war games:...

SolarWinds Hack and the Case of DNS Security

It's not news that some of the top government agencies and companies in the world were victims of the SolarWinds attack. At this point, I can say it's the reason I didn't have a smoother transition back into work-life following a long vacation. As I understand it, the breaches happened after...

Advantech WebAccess/SCADA installation local file inclusion

Summary A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability. Tested Versions Advantech...

CVE-2021-22652: Advantech iView Missing Authentication RCE (FIXED)

Advantech iView versions prior to 5.7.03.6112 suffer from an instance of "CWE-306: Missing Authentication For Critical Function." This vulnerability CVE-2021-22652 has a CVSSv3 score of 9.8, which is usually CRITICAL, since it effectively allows anyone who can connect to the iView server to run...

Azure IoT CLI extension Elevation of Privilege Vulnerability

...

Microsoft Azure IoT CLI Authorization Issues Vulnerability

Microsoft Azure IoT is a centralized managed service from Microsoft Corporation USA. for bi-directional communication between IoT applications and their managed devices. An authorization issue vulnerability exists in the Microsoft Azure IoT CLI. The following products and versions are affected:...

Presidential Cybersecurity and Pelotons

President Biden wants his Peloton in the White House. For those who have missed the hype, its an Internet-connected stationary bicycle. It has a screen, a camera, and a microphone. You can take live classes online, work out with your friends, or join the exercise social network. And all of that i...

Realtek RTL8195A Buffer Overflow Vulnerability (CNVD-2021-56816)

The Realtek RTL8195A is an IoT microcontroller from Realtek Semiconductor Taiwan, China.A buffer overflow vulnerability exists in versions prior to the Realtek RTL8195A 2.08, which could be exploited by an attacker to inject crafted packets into a WPA2 handshake to emulate an access point and...

Realtek RTL8195A Buffer Overflow Vulnerability

The Realtek RTL8195A is an IoT microcontroller from Realtek Semiconductor Taiwan, China.A buffer overflow vulnerability exists in versions prior to the Realtek RTL8195A 2.08, which could be exploited by an attacker to inject crafted packets into a WPA2 handshake to emulate an access point and...

Realtek RTL8195A Buffer Overflow Vulnerability (CNVD-2021-56814)

The Realtek RTL8195A is an IoT microcontroller from Realtek Semiconductor Taiwan, China.A buffer overflow vulnerability exists in versions prior to the Realtek RTL8195A 2.08, which could be exploited by an attacker to inject crafted packets into a WPA2 handshake to emulate an access point and...

Realtek RTL8195A Buffer Overflow Vulnerability (CNVD-2021-56815)

The Realtek RTL8195A is an IoT microcontroller from Realtek Semiconductor Taiwan, China.A buffer overflow vulnerability exists in versions prior to the Realtek RTL8195A 2.08, which could be exploited by an attacker to inject crafted packets into a WPA2 handshake to emulate an access point and...