MeshTNC

MeshTNC MeshTNC is a tool for piping LoRa data to and from consumer grade radios. Code - github.com/datapartyjs/MeshTNC Releases - github.com/datapartyjs/MeshTNC/releases Support - ko-fi/dataparty Features Simple serial cli built into the firmware Transmit raw bytes hex over LoRA using serial CLI...

TPMGenie

TPM Genie TPM Genie is designed to aid in vulnerability research of Trusted Platform Modules. As a serial bus interposer, TPM Genie is capable of intercepting and modifying all traffic that is sent across the I2C channel between the host machine and a discrete TPM chip. Outside of research, the...

adups-get-super-serial

adups-get-super-serial CVE-2015-2231 Proof of Concept The POC I was using to demonstrate CVE-2015-2231 'Get Super Serial'. Was asked by a few people to post it so they could use similar things on other ADUPS firmware based devices which have this vulnerability. Cleaning up the laptop and posting...

bread

🍞 BREAD BREAD BIOS Reverse Engineering & Advanced Debugger is an 'injectable' real-mode x86 debugger that can debug arbitrary real-mode code on real HW from another PC via serial cable. Introduction BREAD emerged from many failed attempts to reverse engineer legacy BIOS. Given that the vast...

wmi-static-spoofer

wmi-static-spoofer Motivation: The initial motivation is bypassing HWID detection methods used by intrusive software like anti-cheats, etc. or licensing restrictions implemented in software. The concept is not new but other solutions require a loaded driver at all times and a kernel hook with...

pyFlipper

PyFlipper Flipper Zero Python CLI Wrapper Articles How to hack a restaurant Functions and characteristics: Flipper serial CLI wrapper Websocket client interface Plain TCP interface What's new firmware 1.x compatibility This release brings the wrapper in line with the current Flipper Zero CLI...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

Realtek RTL8762C SWD Information Disclosure

The vulnerability of the Serial Wire Debug SWD interface in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to improper protection against voltage and clock failures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and...

CVE-2026-128910

The DJI AeroScope Mobile (TP703) is vulnerable to a hard-coded root password (CWE-798) on the 1300 communications board . This flaw affects firmware version 03.00.00.26 (with board firmware 02.00.07.12 through 02.00.08.40 ). An attacker with physical access to the board's serial console can log i...

EUVD-2026-125353

Use of hard-coded credentials CWE-798 on the 1300 communications board in DJI AeroScope Mobile TP703 firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same...

IoT-Implant-Toolkit

IoT-Implant-Toolkit IoT-Implant-Toolkit is a framework of useful tools for malware implantation research of IoT devices. It is a toolkit consisted of essential software tools on firmware modification, serial port debugging, software analysis and stable spy clients. With an easy-to-use and...

CVE-2024-10511

CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...

xdg-dbus-proxy security update

An update is available for xdg-dbus-proxy. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was...

RLSA-2026:98635 Important: xdg-dbus-proxy security update

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fixes: xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows...

CVE-2026-16664

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

CVE-2026-16659

MCUboot's serial-recovery image-upload handler bsupload in boot/bootserial/src/bootserial.c declares const struct flasharea fap = NULL and assigns it only via flashareaopen part-way through the function. Two early validation failures goto outinvaliddata — a CBOR map that fails to decode, or an...

CVE-2026-127928

In MCUboot's serial-recovery encrypted-image support boot/bootserial/src/bootserialencryption.c, decryptimageinplace and bootimagevalidateencrypted each keep a stack-local struct bootstatus. bootencload writes the plaintext per-image AES key into its enckey field. Neither function cleared this...

CVE-2026-127915

The MCUboot TLV iterator bootutiltlviternext in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard it-tlvoff tlvend and advances by sizeofstruct imagetlv + tlv.itlen using the attacker-controlled itlen field, without validating that the entry's header or payload stays withi...

CVE-2026-127915

The MCUboot bootloader contains an out-of-bounds read vulnerability in the bootutil_tlv_iter_next() function within boot/bootutil/src/tlv.c. The iterator fails to validate that the header and payload of each TLV entry stay within the declared tlv_end boundary, potentially allowing it to read up t...

CVE-2026-127915 TLV iterator does not bound each entry against the declared TLV area in MCUboot bootutil

The MCUboot TLV iterator bootutiltlviternext in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard it-tlvoff tlvend and advances by sizeofstruct imagetlv + tlv.itlen using the attacker-controlled itlen field, without validating that the entry's header or payload stays withi...