Insular

Insular Isolate your big brother app. This is a fork based on the excellent Island. Extra credit to Shelter which inspired me to make the completely FLOSS fork of Island. Documentation On how to enable Insular via adb, cross-profile file access, God mode extending app control to apps outside the...

BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...

bitlocker-attacks

BitLocker 攻撃 BitLocker に対する公開攻撃の一覧です。BitLocker を攻撃する 可能性 はあるものの、正確な手法がまだ公開されていない公開攻撃（baton drop など）は対象外です。 ほとんどの攻撃は、VMK が TPM のみによってシールされる設定（デフォルト設定）を対象としています。これは、自動 BitLocker が回復キーの Microsoft アカウントへのエスクローと併せて使用する設定です。 既定では、Windows 8 以降、Secure Boot が有効な場合に Secure Boot 整合性検証が使用されます。 VMK を TPM...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extracting-User-credentials-For-Hathway-Router Via SPI flash-CVE-2024-44815 Vulnerability Description: During the security assessment of the Router firmware, it was observed that router login credentials of both web portal and Wi-Fi access point are stored in plain text in SPI flash memoey...

CVE-2025-51643

CVE-2025-51643: 保護されていないSPIフラッシュによりMeitrack T366G-Lのファームウェア抽出が可能 説明 Meitrack T366G-L GPSトラッカーデバイスには、認証や改ざん防止が施されていないSPIフラッシュチップ（Winbond...

CVE-2017-16778-Intercom-DTMF-Injection

Invoking DTMF Tones for Physical Access Grant on Fermax Lift Intercom System CVE-2017-16778 Special Mentions First and foremost, @dizijoyjoy for assisting on the demo set in order for a successful shoot. Special acknowledgement to Fermax for the prompt response to the security bug report on their...

CVE-2022-38694_unlock_bootloader

CVE-2022-38694 An attacker with physical access to the device can overwrite a function pointer somewhere in the BootROM data section or a return address stored on the stack and execute their own code with BootROM privileges. For detailed information, read the article by NCC Group. Quick links: To...

CVE-2025-63296

CVE-2025-63296 요약 KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera 펌웨어 v33.53.87 은 부팅/업데이트 로직에 코드 실행 취약점 을 포함하고 있습니다. 시작 중에 /usr/sbin/anykaservice.sh가 마운트된 TF/SD 카드를 검사하고, /mnt/update.nor.sh가 존재하면 /tmp/net.sh로 복사하여 root로 실행하므로, 물리적 접근이 있는 공격자가 임의 명령을 실행할 수 있습니다. 세부 정보 취약 엔드포인트 :...

Mediatrix-CVE-2022-43096

CVE-2022-43096 CVSS v3.1 Vector: AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N 7,3 Description Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. Vulnerability Type Incorrect Access Control Vendor of Product Mediatrix Affected Product Code Base Mediatrix 4102 -...

CVE-2025-65731

CVE-2025-65731 CWE-1191: 부적절한 접근 제어가 적용된 온칩 디버그 및 테스트 인터페이스 D-Link DIR-605L에서의 UART 루트 셸 액세스 하드웨어 F1, 펌웨어 V6.02CN02 요약 D-Link DIR-605L 라우터하드웨어 버전 F1, 펌웨어 외부 버전 V6.02CN02, Linux 커널 2.4.18 실행에서 심각한 하드웨어 보안 취약점이 확인되었습니다. UART 디버그 인터페이스에는 적절한 접근 제어 메커니즘이 없어, 물리적 접근이 가능한 모든 공격자가 UART 핀에 연결하여 인증 없이 루트 ...

CVE-2026-102370

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2026-102370

The TP-Link Kasa EC70 v4 and EC71 v4 devices are vulnerable because the production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. While debug traces are physically severed during manufacturing, an attacker with physical access can res...

EUVD-2026-91060

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2026-32606-POC

CVE-2026-32606 の概念実証（PoC） このリポジトリには、1年以上前に https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/ で最初に説明された一般的な弱点を悪用する、シンプルな概念実証コードが含まれています。特に IncusOS を対象としていますが、この攻撃はほとんどの最新 Linux システムに対してかなり汎用的です。 TL;DR LUKS 暗号化を TPM にバインドする場合は、必ず TPM に PIN も設定してください。 免責事項 これは簡易的な PoC...

Armatura LLC Armatura One

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. 2. RECOMMENDED PRACTICES CISA...

PT-2026-104017

Name of the Vulnerable Software and Affected Versions Kasa EC70 v4 Kasa EC71 v4 Description The production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. An attacker with physical access can restore physically severed debug traces to...

Linux Distros Unpatched Vulnerability : CVE-2026-71974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds...

EUVD-2026-89432

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-71974

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...