ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion

Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences /../, conduct directory traversal attacks, and view arbitrary files. id: CVE-2018-19326 info: name: Zyxel VMG1312-B10D...

Puma6Fail

Demo del difetto Puma 6 Strumento per dimostrare il problema di questo post trovato da mackey: https://www.dslreports.com/forum/r31377755- Il codice di proof of concept è già pubblico altrove. Vedi CVE-2017-5693. Il DoS avviene in entrambe le direzioni - UDP da LAN a WAN o da WAN a LAN. Test...

hitron-cfg-decrypter

Decifratore CFG Hitron Download root@kitploit: git clone https://github.com/Manouchehri/hitron-cfg-decrypter cd hitron-cfg-decrypter/ Decifratura root@kitploit: python decrypt.py -i sample.cfg.enc Cifratura root@kitploit: python decrypt.py -i sample.cfg.dec -m encrypt Ottenere il CFG Grazie a...

psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

qualcomm_baseband_scripts

qualcommbasebandscripts Sammlung von Skripten zum Reverse Engineering der Qualcomm-Baseband-/Modem-Firmware Alle Offsets/Adressen in den Skripten wurden auf die Pixel-5-März-Firmware aktualisiert und müssen geändert werden, wenn du eine andere Version verwendest. Zusammenführen...

Cable-modems

Analyse von WiFi-fähigen ISP-Modems Überblick Die SEARCH-LAB Ltd. hat fünf Heim-Gateway-Modelle evaluiert, die alle von vielen Internetdienstanbietern weltweit eingesetzt werden; die tatsächlichen Geräte wurden jedoch von einem der ungarischen Kabel-TV-Betreiber, UPC Magyarország...

CVE-2017-9476

CVE-2017-9476 AP nascosto con credenziali deterministiche. Compilazione root@kitploit: cc xhscmmac2psk.c -o xhscmmac2psk Utilizzo root@kitploit: ./xhscmmac2psk L'algoritmo è stato anche aggiunto a PSKracker. Riferimenti CVE-2017-9476 Bastille-18.home-security-wifi-network.txt whitepaper del DEFCO...

CVE-2025-24990_POC

Windows Agere Modem Driver ltmdm64.sys. Questo driver è molto vecchio e non viene caricato di default sulla mia macchina di test, quindi lo sfrutterò in uno scenario BYOVD. Curiosamente, secondo le mie ricerche questo driver esisteva su Windows 7 e ha almeno un bug. qui A quel tempo, MSRC non ha...

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario-

CVE-2026-20404-MediaTek-Modem-Remote-DoS-Rogue-Base-Station-Szenario- Eine Eingabevalidierungsproblematik im MediaTek-Modem kann einen Systemabsturz Remote-DoS verursachen, wenn sich ein UE mit einer von einem Angreifer kontrollierten, bösartigen Basisstation verbindet – ohne dass eine...

ghidra-nanomips

ghidra-nanomips nanoMIPS module for Ghidra. Setup Build root@kitploit: $ ./gradlew -PGHIDRAINSTALLDIR=/opt/ghidra11.0.3 Install The Gradle build task creates a ZIP file in the dist directory. Install it with File Install Extensions in the main Ghidra project window. Reference Material "MIPS...

libpo32

libpo32 Uma pequena biblioteca C99 para transferências de dados acústicos e síntese de bateria do PO-32 da Teenage Engineering. O libpo32 reimplementa a pilha de transferência do PO-32 Tonic e um modelo de voz de bateria compatível. Não é um firmware completo do PO-32 nem um emulador de interface...

D-Link

D-Link CVE-2017-12943 Spiegazione della vulnerabilità di intrusione nel modem D-Link La vulnerabilità pubblicata di recente consente di accedere al modem senza bisogno della sua password; il metodo è molto semplice, si basa solo su dorks da inserire. In questo episodio ti mostrerò come sfruttare ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check the control transfer buffer size before accessing it. If the first fragment is shorter than struct usbcdcnotification, we cannot calculate the expectedsize. Instead, log an error and discard the notification...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the tty subsystem, for the ngsm module, a race condition occurred during the modification of the status line of a dead connection. The gsmcleanupmux function cleans up the GSM-related resources by closing all Data Link Control...

Astra Linux – Vulnerability in Zabbix

Zabbix allows for the configuration of SMS notifications. AT command injection occurs on the “Zabbix Server” because there is no validation of the “Number” field either on the web interface or on the Zabbix server side. An attacker can send specially crafted phone numbers via SMS and execute...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb-frags overflow in the RX path When receiving data in the DPMAIF RX path, the t7xxdpmaifsetfragtoskb function adds page fragments to an skb without checking whether the number of fragments has...

Astra Linux – Vulnerability in Zabbix

Setting the SMS media allows for setting the GSM modem file. This file is later used as a Linux device. But since everything is a file for Linux, it’s possible to set another file, such as a log file. In this case, Zabbixserver will attempt to communicate with it as a modem. As a result, the log...

CVE-2026-12520

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

CVE-2026-12519

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...