Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extracting-User-credentials-For-Hathway-Router Via SPI flash-CVE-2024-44815 Vulnerability Description: During the security assessment of the Router firmware, it was observed that router login credentials of both web portal and Wi-Fi access point are stored in plain text in SPI flash memoey...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383 Vulnerability Description: During the security assessment of the Router firmware, it was observed that sensative information regarding the devices connected to router such as Mobile phone,Laptos, Tablets is...

SpiMitm

+OPTIONS: ^: SpiMitm - SPI flash read MitM attack PoC for anti-firmware forensics This PoC is focused on https://up-board.org/upsquared/specifications/UP Squared. How to use Follow Alan Sguigna's build process explained...

Exploit-Writeups

This is a collection of exploit writeups that I've authored: PS3 lv0ldr SPI MITM...

CVE-2025-51643

CVE-2025-51643: Unprotected SPI Flash Enables Firmware Extraction in Meitrack T366G-L Description Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access can attach a standar...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

CVE-2026-42806

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI C-driver in version v1.0.3 and prior, specifically within the field data parsing logic in readallfielddata bme69x.c. The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer setval...

yaml-payload-2

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to...

The vulnerability of the pch_spi_pdremove() function in the drivers/spi/spi-topcliff-pch.c driver module of the Linux operating system’s SPI device drivers allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pchspipdremove function in the drivers/spi/spi-topcliff-pch.c driver for Linux’s SPI device drivers is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

UBUNTU-CVE-2026-80752

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80752

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

The vulnerability of the s3c64xx_spi_remove() function in the drivers/spi/spi-s3c64xx.c file of the Linux operating system’s SPI device driver allows a attacker to cause a service failure.

The vulnerability of the s3c64xxspiremove function in the drivers/spi/spi-s3c64xx.c file of the Linux kernel’s SPI device driver is related to the pointer dereferencing. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the mcp23s08_probe() function in the drivers/pinctrl/pinctrl-mcp23s08_spi.c driver for Linux kernel’s PINCTRL output devices allows a hacker to cause a service failure.

The vulnerability of the mcp23s08probe function in the drivers/pinctrl/pinctrl-mcp23s08spi.c file of the Linux kernel’s GPIO controller driver is related to the pointer assignment. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-80752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend...

AZL-99068 CVE-2026-80752 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80752

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

EUVD-2026-70356

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80752

A NULL pointer dereference exists in the Linux kernel's psxpad-spi input driver. The psxpad_spi_suspend() function calls spi_get_drvdata() to retrieve the controller state, but the probe function never stores that data, so any suspend operation dereferences a NULL pointer, likely causing a kernel...

CVE-2026-80752 Input: psxpad-spi - set driver data before use

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...