22 matches found
tesla-security-research
Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...
IoT-Vulnerability-Research-Public
Hardware Security & Vulnerability Research This repository serves as a centralized public archive for my independent vulnerability research, hardware audits, and Coordinated Vulnerability Disclosures CVD. All proof-of-concept scripts, firmware extractions, and hardware teardowns are published her...
chronomaly-webos
Chronomaly — CVE-2025-38352 on LG webOS Kernel exploit for CVE-2025-38352 POSIX CPU timer race condition / use-after-free achieving persistent root on LG webOS Smart TVs running kernel 5.4.268 on ARM64. Verified on 4 TV models across multiple firmware versions. Responsibly disclosed to LG's...
hp-slate7-root-kit
Root for the HP Slate 7 2800 on Android 4.1.1 English | Русский This repository contains a complete, self-contained kit for obtaining persistent root access on the HP Slate 7 2800 running firmware 1.05.18 and kernel Linux 3.0.8+ by exploiting the local vulnerability CVE-2015-1805. The kit was run...
root-sonim-xp3800
Root Sonim XP3800 Root access for the Sonim XP3800. Two methods are available — choose whichever fits your situation. Root Manager App The Root Manager app exploits CVE-2019-2215 a binder use-after-free kernel vulnerability to gain root directly on the device. No computer, no bootloader unlock, n...
Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware
iQOO Neo7 Racing Edition PD2232 – BL-Free Privilege Escalati...
CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
CVE-2026-78237
Admin By Request (ABR) for macOS is affected by an insufficient input validation flaw (CVE-2026-78237, CVSS 7.8 HIGH ). A low-privileged local user can inject malicious entries into the sudoers file during an ABR session, granting persistent root access that remains effective even after the eleva...
PT-2026-81976
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
CVE-2026-72841
luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...
Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
RefluXFS, a Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and...
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Linux Linux_Kernel
Chronomaly — CVE-2025-38352 on LG webOS Kernel exploit for C...
Default credentials
D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting the super user password...
CVE-2012-6614
CVE-2012-6614 affects the D-Link DSR-250N family, specifically firmware versions before 1.08B31. The vulnerability allows remote authenticated users to obtain persistent root access via the BusyBox CLI, demonstrated by overwriting the superuser password. Reported impact includes high confidential...
CVE-2012-6614: Missing Authorization
D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting the super user password...
CVE-2012-6613
D-Link DSR-250N devices with firmware 1.05B73WW allow Persistent Root Access because of the admin password for the admin account...
Design/Logic Flaw
D-Link DSR-250N devices with firmware 1.05B73WW allow Persistent Root Access because of the admin password for the admin account...