PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Windows Wi-Fi Driver RCE Vulnerability – CVE-2024-30078

crowdfense.com | vulnerability | CVE-2024-30078 | #rce | #windows | #vulnerability-analysis | #cve-2024-30078 | #wifi-driver | #nwifi | #bindiff
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Root-cause analysis of CVE-2024-30078 in Windows' nwifi.sys Wi-Fi driver: a missing length check in Dot11Translate80211ToEthernetNdisPacket enables potential over-the-air RCE with heavy constraints.
CVE
CVE-2024-30078
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bishopfox.com
Signature Optional - Analysis of CVE-2026-28323
CVE-2026-28323 is a CVSS 9.8 SAML auth bypass in SolarWinds Web Help Desk. A single forged POST request grants unauthenticated access to any valid account.
vulnerability · yeswehack.com
Log4Shell, Ten Days On: YesWeHack’s Hunters Are at the Forefront of Securing Organisations
Ten days after Log4Shell, YesWeHack explains why the ubiquitous Log4j library became the internet's Achilles' heel and how its hunter community helped organisations respond to the fallout.
vulnerability · bugcrowd.com
Big Bugs | Episode 5: Big XSS–Not an Oxymoron
Big Bugs Episode 5 argues that 'big XSS' is not an oxymoron: though XSS is often dismissed as low-hanging fruit, exploit chains show it can drive ransomware and full account takeover.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
Back