MSC-EvilTwin-Local-Privilege-Escalation

CVE-2025-26633 - Microsoft Management Console .msc EvilTwin 로컬 권한 상승 PoC 공개 시점의 제로데이 2025년 3월 – Water Gamayun APT에 의해 실제 환경에서 활발히 악용됨 공인된 보안 테스트 및 연구용으로만 사용 취약점 세부 정보 익스플로잇 제목 : Microsoft Management Console MMC - MSC EvilTwin 로컬 권한 상승 / 임의 코드 실행 CVE : CVE-2025-26633 CVSS v3.1 : 7.8 높음 –...

cip-security-poc

cip-security-poc — CVE-2021-22681 뒤에 있는 수정 원리 를 입증 단순한 결함만이 아님 실행 가능한 스크립트 6개 — 실제 EtherNet/IP 프로토콜 트래픽테스트 1, 실제 TLS/PKI 메커니즘 테스트 36 — 체인 어디에도 Rockwell 소프트웨어나 라이선스가 없습니다. 주장을 신앙으로 받아들이기 위한 것이 아니라, 문서로 작성하기 전에 주장을 검증하기 위해 구축되었습니다. 출처: 2026-07-31에 구축되었으며, 미네소타주 브라함Braham WWTF에 대한 병행 조사와 함께 진행 — 202...

CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra CVE-2024-21412 を介したマルウェア配信 使用方法 サービスを順番に起動し、Webサーバーにアクセスします Webサーバー フォルダ内でWebサーバーを起動します: python -m http.server Initial Access: Windows 詳細クエリ構文（AQS）を使用してWebDAV共有にリンクするJPEGトロイの木馬 Initial Access: search: プロトコルを使用してWindowsエクスプローラーウィンドウをカスタマイズ search:...

Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Forescout found 22 internet-facing Rockwell Automation programmable logic controllers PLCs in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the Unit...

Iran Cyberattacks Against Minnesota Water Systems

Attribution is preliminary, and so far it seems no real damage. And it seems like this is a campaign that has targeted at least seven states. And, because this is where the US is right now, Trump doesn't believe it's Iran and thinks Minnesota…I guess…hacked itself. "I think I blame it on Minnesot...

7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran

Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed...

Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline

A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. Braham, Plymouth, South St. Paul and Maple Plain have publicly described a plant outage, communications failures or affecte...

PYSEC-2026-1437 h2o vulnerable to unexpected POST request shutting down server

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

MINI-WC44-29QX-V8VF

Bulletin has no description...

CVE-2026-5667 Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Packaged Air Conditioners for Japan and outside Japan; Refrigerators for...

Handala Hacking Group Claims Breach of California Water Service

The Handala hacking group claims it has targeted California Water Service, leaking 5GB of customer database and GPS network files in its latest infrastructure attack...

CVE-2026-50244

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water...

CVE-2026-42932

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated...

CVE-2026-50244 Naxclow IoT Platform Missing Authorization

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water...

CVE-2026-50244

CVE-2026-50244 affects the Naxclow IoT Platform. The registration endpoint accepts signed requests with a batch prefix and a caller-supplied account identifier without ownership validation, allowing an attacker to mint new sequential device identifiers and read the batch’s current high-water coun...

EUVD-2026-36533

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water...

CVE-2026-42932

The CVE-2026-42932 entry concerns the Naxclow IoT Platform where identifier generation uses fixed manufacturing prefixes with sequential counters, creating a fully predictable and enumerable identifier space. An exposed endpoint reveals the current identifier high-water mark, enabling enumeration...

CVE-2026-42932 Naxclow IoT Platform Generation of Predictable Numbers or Identifiers

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated...

EUVD-2026-36532

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated...

CVE-2026-42932 Naxclow IoT Platform Generation of Predictable Numbers or Identifiers

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated...