CVE-2019-10540

Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2019-10501

The CVE-2019-10501 entry affects Qualcomm Snapdragon volumes listener library across multiple Snapdragon platforms. Root cause: use-after-free caused by improper input validation in the volume listener component. Reported impact indicates partial confidentiality, integrity, and availability at a ...

CVE-2019-2333

Technical details about CVE-2019-2333 are not publicly provided in the supplied documents. Monitor for updates as more specifics (affected components, root cause, remediation) may be disclosed in future disclosures.

CVE-2019-10497

Technical details about CVE-2019-10497 are not publicly provided in the supplied documents. No specifics on affected products, root cause, or fixes are available here. Monitor for updates.

CVE-2019-10510

CVE-2019-10510 is described as a null pointer dereference affecting Bluetooth on Qualcomm Snapdragon platforms (e.g., BTHOST) when a remote invalid vendor command is processed. The issue is noted across Qualcomm components with high severity and CVSS 3.1/2.0 ratings, and the vulnerability is list...

CVE-2019-10498

CVE-2019-10498 describes a buffer overflow in a Qualcomm closed‑source component triggered when a client sends more than 5 io_vec requests to the server. Affected products span Snapdragon Auto/Compute, Snapdragon IoT devices, and related Snapdragon/SDM families (e.g., SD 210–855, various Snapdrag...

CVE-2019-10497

Use after free issue occurs If another instance of open for voicesvc node has been called from application without closing the previous one. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in...

CVE-2019-10508

CVE-2019-10508 describes a vulnerability due to lack of input validation for data received from user space, which can cause out-of-bounds access in WLAN on Snapdragon devices. Affected families include Snapdragon Auto, Snapdragon Connectivity, Snapdragon IOT, Snapdragon Mobile, and others listed ...

CVE-2019-2341

CVE-2019-2341 describes a buffer overflow in the audio subsystem when a user-provided audio buffer size exceeds the maximum allowed. Affected: Snapdragon SoCs and families listed in the entry (e.g., Snapdragon Auto/Compute/IoT, Snapdragon Mobile, Wearables, etc.). Root cause: unchecked size in au...

Building the Azure IoT Edge Security Daemon in Rust

Azure IoT Edge is an open source, cross platform software project from the Azure IoT team at Microsoft that seeks to solve the problem of managing distribution of compute to the edge of your on-premise network from the cloud. This post explains some of the rationale behind our choice of Rust as t...

Building the Azure IoT Edge Security Daemon in Rust

Azure IoT Edge is an open source, cross platform software project from the Azure IoT team at Microsoft that seeks to solve the problem of managing distribution of compute to the edge of your on-premise network from the cloud. This post explains some of the rationale behind our choice of Rust as t...

This Week in Security News: Fake Apps on iOS and Google Play and Social Media Security Issues

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the evolution of EDR to XDR and why your CISO should care, stock trading app attacks and fake gambling apps. Also, read about ho...

5G and IoT: How to Approach the Security Implications

When it comes to the next generation of mobile networks, 5G promises a more Internet of Things-friendly ecosystem with vast improvements over the current capabilities of 4G – however, its intersection with IoT will also raise the stakes on cybersecurity. The benefits of 5G are myriad: Not only wi...

Firmware Analysis Toolkit - Toolkit To Emulate Firmware And Analyse It For Security Vulnerabilities

FAT is a toolkit built in order to help security researchers analyze and identify vulnerabilities in IoT and embedded device firmware. This is built in order to use for the "Offensive IoT Exploitation " training conducted by Attify. Download AttifyOS Note: As of now, it is simply a script to...

15,000 webcams vulnerable to attack: how to protect against webcam hacking

Webcams may have been around for a long time, but that doesn’t mean we know what we’re doing with them. Webcam hacking has been around for equally as long, yet new research from Wizcase indicates that more than 15,000 private, web-connected cameras are exposed and readily accessible to the genera...

125 New Flaws Found in Routers and NAS Devices from Popular Brands

The world of connected consumer electronics, IoT, and smart devices is growing faster than ever with tens of billions of connected devices streaming and sharing data wirelessly over the Internet, but how secure is it? As we connect everything from coffee maker to front-door locks and cars to the...

This Week in Security News: IoT Devices Are a Target in Cybercriminal Underground

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn how fileless malware abuses PowerShell. Also, read how Trend Micro researchers are pulling back the curtain on the cybercriminal...

News Wrap: IoT Radio Telnet Backdoor And 'SimJacker' Active Exploit

Threatpost editors break down the biggest news stories of this week ended Sept. 13, including: Researchers warning that more than one billion mobile users are at risk from a SIM card flaw being currently exploited by threat actors A Telnet backdoor opened more than 1 million Imperial Dabman IoT...

It's Time for IoT Security's Next Big Step

Connected devices are more secure than ever. That's still not nearly enough...

Unauthorized Access Vulnerability in Baidu's Skyworks Intelligence Platform

Baidu Tiangong Intelligence Platform is a cloud service platform for the IoT field, which communicates through mainstream IoT protocols e.g., MQTT, allowing IoT projects to be built between smart devices and the cloud. The Baidu Tiangong Intelligent Platform suffers from an unauthorized access...