PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Lỗ hổng trên dòng ONT IGate GW040

blog.viettelcybersecurity.com | blog | #botnet | #command-injection | #iot-security | #router | #firmware-analysis | #tr-069 | #binwalk
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Research on ONT IGate GW040 routers: the crontab and weakly secured TR-069 features allow easy botnet recruitment, and firmware analysis uncovered command injection in /bin/httpd via IPSec requests.
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
Lỗ hổng trên thiết bị D-link
A researcher dissects a buffer overflow in the D-Link DIR-601 web service: request paths are concatenated via strcat without length checks, so a long URL overflows the buffer on this EOL router.
blog · blog.viettelcybersecurity.com
The first step to PWN2OWN - A sad one
A researcher's first find: LAN-side command injection in the NETGEAR RAX30 UPnP service via a malicious SOAPACTION header embedded into a logger command; patched just before Pwn2Own Toronto 2022.
blog · blog.viettelcybersecurity.com
Thành phố thông minh có thể bị hack như thế nào
Researchers assessing Akuvox smart intercoms used in smart cities found command injection, hardcoded Android credentials, default-cert web config and unauthenticated RTSP camera flaws, now patched.
blog · bishopfox.com
Product Security Review Methodology for Traeger Grill Hack
How Bishop Fox reviewed the Traeger D2 Wi-Fi grill controller: opening the PCB, tracing ESP32 UART pins, forcing download mode to dump firmware, and analyzing the pairing HTTP server for flaws.
vulnerability · blog.viettelcybersecurity.com
TP-Link TL-WR940N: 1-days analysis after story. (CVE-2022-43636 & CVE-2022-43635)
Analysis of TP-Link TL-WR940N (CVE-2022-43636/43635): AuthPass() in the RSA/AES-protected login flow always returns success, letting attackers reuse stale session IDs to bypass authentication.
vulnerability · blog.viettelcybersecurity.com
1day to 0day(CVE-2022-30024) on TP-Link TL-WR841N
Studying TP-Link TL-WR841N firmware, the author revisits CVE-2020-8423 and finds 0-day CVE-2022-30024: stringModify() miscounts escaped characters, overflowing a stack buffer via the survey page.
Back