SpiMitm

+OPTIONS: ^: SpiMitm - SPI flash read MitM attack PoC for anti-firmware forensics This PoC is focused on https://up-board.org/upsquared/specifications/UP Squared. How to use Follow Alan Sguigna's build process explained...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extracting-User-credentials-For-Hathway-Router Via SPI flash-CVE-2024-44815 Vulnerability Description: During the security assessment of the Router firmware, it was observed that router login credentials of both web portal and Wi-Fi access point are stored in plain text in SPI flash memoey...

Exploit-Writeups

This is a collection of exploit writeups that I've authored: PS3 lv0ldr SPI MITM...

yaml-payload-2

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383 Vulnerability Description: During the security assessment of the Router firmware, it was observed that sensative information regarding the devices connected to router such as Mobile phone,Laptos, Tablets is...

spidump

spidump — SPI/QSPI trace capture & reconstruction spidump parses logic-analyzer captures of a device reading its SPI/QSPI NOR flash at boot and reconstructs the flash image from the read traffic — no direct chip read required. The flash command set is modelled with Scapy, so a read transaction is...

ftpm_attack

faulTPM - Artifacts This repository aims to reproduce the results of our fTPM attack without any hardware access. Where physical steps and access to real hardware would be required, we provide sample data from a Lenovo Ideapad 5 Pro 16ACH6 laptop. Requirements Python 3.8 Update submodules: git...

CVE-2025-51643

CVE-2025-51643: Unprotected SPI Flash Enables Firmware Extraction in Meitrack T366G-L Description Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access can attach a standar...

CVE-2026-0470

Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability...

CVE-2026-0470

Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability...

CVE-2026-0470

A null pointer dereference vulnerability exists in the AMD Embedded SPI Flash driver . This flaw could allow a local user to potentially cause a loss of availability (High Availability impact). The vulnerability is categorized under CWE-476 .

EUVD-2026-123482

Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability...

CVE-2026-0470: AMD: Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of…

Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability...

PT-2026-145230

Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability...

CVE-2026-90832

bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...

CVE-2026-90832

bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

AMD Embedded SPI Flash Driver Vulnerability

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0470| Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.| 5.6...

PT-2026-144852

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the bt hci le per adv report common function within subsys/bluetooth/host/scan.c when handling HCI LE Periodic Advertising Report and HCI LE Periodic Advertising Report v2...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: Control the built-in chip select manually. The coreQSPI IP supports only a single chip select, which is automatically operated by the hardware—set low when the transmit buffer is first written to, and se...