PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Thành phố thông minh có thể bị hack như thế nào

blog.viettelcybersecurity.com | blog | #command-injection | #iot-security | #vulnerability-analysis | #akuvox | #smart-city | #rtsp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Researchers assessing Akuvox smart intercoms used in smart cities found command injection, hardcoded Android credentials, default-cert web config and unauthenticated RTSP camera flaws, now patched.
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
The first step to PWN2OWN - A sad one
A researcher's first find: LAN-side command injection in the NETGEAR RAX30 UPnP service via a malicious SOAPACTION header embedded into a logger command; patched just before Pwn2Own Toronto 2022.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên dòng ONT IGate GW040
Research on ONT IGate GW040 routers: the crontab and weakly secured TR-069 features allow easy botnet recruitment, and firmware analysis uncovered command injection in /bin/httpd via IPSec requests.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên thiết bị D-link
A researcher dissects a buffer overflow in the D-Link DIR-601 web service: request paths are concatenated via strcat without length checks, so a long URL overflows the buffer on this EOL router.
blog · blog.viettelcybersecurity.com
Kiểm tra vài camera Trung Quốc và cái kết
A researcher tests three cheap Chinese cameras, finding default telnet credentials, command injection in CGI functions and unauthenticated RCE via firmware update parsing.
blog · bishopfox.com
Bishop Fox Wrapped: Research Worth Replaying
Bishop Fox Wrapped: the year's most-revisited research, sessions, and posts, covering social engineering, vulnerability research, mobile testing, deepfakes, IoT hacking, and LLM pen testing.
Back