80 matches found
laf
LoRaWAN 監査フレームワーク - アルファ版 IoTデプロイメントは成長を続けており、その大きな成長の一部は、世界中の何百もの都市（スマートシティ）や産業、家庭に展開された数百万のLPWAN（低消費電力広域ネットワーク）センサーで構成されています。最も使用されているLPWAN技術の1つがLoRaであり、LoRaWANはそのネットワーク標準（MAC層）です。LoRaWANは暗号化を組み込んだ安全なプロトコルですが、実装上の問題や脆弱性が現在のほとんどのデプロイメントのセキュリティに影響を与えています。...
Loracrack
Loracrack - LoRaWAN 会话破解工具 一个利用弱密钥或共享应用密钥的 PoC 由 Applied Risk 的 Sipke Mellema 创建 这是一个概念验证（PoC），用于演示在多个 LoRaWAN 节点上使用相同 AppKey 的危险性。 该仓库包含一个工具箱，用于从捕获的数据包中破解 LoRaWAN 会话密钥。攻击场景假设您知道 AppKey 但错过了握手过程。或者 AppKey 不是随机的，可以被猜测出来。 LoRa 握手使用三个值来生成会话密钥： AppNonce | NetID | DevNonce AppNonce 和 NetID 为 3...
CVE-2026-13479
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13480
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
EUVD-2026-66556
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...
CVE-2026-13480
CVE-2026-13480 is an out-of-bounds read in the Zephyr RTOS LoRaWAN TS004 Fragmented Data Block Transport (FUOTA) downlink handler (frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c). The handler fails to validate remaining payload length before casting to a 10-byte set...
CVE-2026-13479
CVE-2026-13479 is an out-of-bounds read in the LoRaWAN clock-synchronization service of Zephyr RTOS (subsys/lorawan/services/clock_sync.c). When processing the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) downlink, the handler reads a 4-byte time correction and 1-byte token without verifying that 5 bytes...
EUVD-2026-66555
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...
EUVD-2026-66229
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...