#iotsec — Public Fediverse posts

CVE-2026-13214 (CRITICAL, CVSS 9.8) in Zephyr OCPP 1.6 client: Unbounded strcpy() in parse_getconfig_msg() enables RCE/DoS via stack overflow. Affects =4.3.0, >=4.3.0 <4.4.2. Restrict untrusted WebSocket access. Patch status pending. https://radar.offseq.com/threat/cve-2026-13214-memory-safety-in-zephyrproject-zephyr-042d724fd93f46c2 #OffSeq #Zephyr #CVE202613214 #IoTSec

CVE-2026-13214 (CRITICAL, CVSS 9.8) in Zephyr OCPP 1.6 client: Unbounded strcpy() in parse_getconfig_msg() enables RCE/DoS via stack overflow. Affects =4.3.0, >=4.3.0 <4.4.2. Restrict untrusted WebSocket access. Patch status pending. https://radar.offseq.com/threat/cve-2026-13214-memory-safety-in-zephyrproject-zephyr-042d724fd93f46c2 #OffSeq #Zephyr #CVE202613214 #IoTSec

CVE-2026-13214 (CRITICAL, CVSS 9.8) in Zephyr OCPP 1.6 client: Unbounded strcpy() in parse_getconfig_msg() enables RCE/DoS via stack overflow. Affects =4.3.0, >=4.3.0 <4.4.2. Restrict untrusted WebSocket access. Patch status pending. https://radar.offseq.com/threat/cve-2026-13214-memory-safety-in-zephyrproject-zephyr-042d724fd93f46c2 #OffSeq #Zephyr #CVE202613214 #IoTSec

CVE-2026-13214 (CRITICAL, CVSS 9.8) in Zephyr OCPP 1.6 client: Unbounded strcpy() in parse_getconfig_msg() enables RCE/DoS via stack overflow. Affects =4.3.0, >=4.3.0 <4.4.2. Restrict untrusted WebSocket access. Patch status pending. https://radar.offseq.com/threat/cve-2026-13214-memory-safety-in-zephyrproject-zephyr-042d724fd93f46c2 #OffSeq #Zephyr #CVE202613214 #IoTSec

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

🔎 HIGH-severity (CVSS 8.7) buffer overflow in Shenzhen Libituo LBT-T300-HW1 (v1.2.0 – 1.2.8), CVE-2026-7674. Web Management Interface at risk, remote exploit possible. No patch yet — restrict access & stay alert. https://radar.offseq.com/threat/cve-2026-7674-buffer-overflow-in-shenzhen-libituo--817395ad #OffSeq #Vuln #IoTSec #Infosec

🔎 HIGH-severity (CVSS 8.7) buffer overflow in Shenzhen Libituo LBT-T300-HW1 (v1.2.0 – 1.2.8), CVE-2026-7674. Web Management Interface at risk, remote exploit possible. No patch yet — restrict access & stay alert. https://radar.offseq.com/threat/cve-2026-7674-buffer-overflow-in-shenzhen-libituo--817395ad #OffSeq #Vuln #IoTSec #Infosec

🔎 HIGH-severity (CVSS 8.7) buffer overflow in Shenzhen Libituo LBT-T300-HW1 (v1.2.0 – 1.2.8), CVE-2026-7674. Web Management Interface at risk, remote exploit possible. No patch yet — restrict access & stay alert. https://radar.offseq.com/threat/cve-2026-7674-buffer-overflow-in-shenzhen-libituo--817395ad #OffSeq #Vuln #IoTSec #Infosec

🔎 HIGH-severity (CVSS 8.7) buffer overflow in Shenzhen Libituo LBT-T300-HW1 (v1.2.0 – 1.2.8), CVE-2026-7674. Web Management Interface at risk, remote exploit possible. No patch yet — restrict access & stay alert. https://radar.offseq.com/threat/cve-2026-7674-buffer-overflow-in-shenzhen-libituo--817395ad #OffSeq #Vuln #IoTSec #Infosec

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec

🔒 CVE-2026-5851: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote, unauthenticated RCE possible via /cgi-bin/cstecgi.cgi. Exploit public, no patch. Isolate device and check for updates! https://radar.offseq.com/threat/cve-2026-5851-os-command-injection-in-totolink-a71-cec71662 #OffSeq #CVE20265851 #IoTSec

🔒 CVE-2026-5851: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote, unauthenticated RCE possible via /cgi-bin/cstecgi.cgi. Exploit public, no patch. Isolate device and check for updates! https://radar.offseq.com/threat/cve-2026-5851-os-command-injection-in-totolink-a71-cec71662 #OffSeq #CVE20265851 #IoTSec

🔒 CVE-2026-5851: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote, unauthenticated RCE possible via /cgi-bin/cstecgi.cgi. Exploit public, no patch. Isolate device and check for updates! https://radar.offseq.com/threat/cve-2026-5851-os-command-injection-in-totolink-a71-cec71662 #OffSeq #CVE20265851 #IoTSec

🔒 CVE-2026-5851: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote, unauthenticated RCE possible via /cgi-bin/cstecgi.cgi. Exploit public, no patch. Isolate device and check for updates! https://radar.offseq.com/threat/cve-2026-5851-os-command-injection-in-totolink-a71-cec71662 #OffSeq #CVE20265851 #IoTSec

Masjesu Botnet neu unterwegs: DDoS-for-Hire via Telegram, infiziert IoT (Router/Gateways, multi-arch). Hohe Persistence, vermeidet Blacklists/CI. Default-Passwörter killen! THN: https://thehackernews.com/2026/04/masjesu-botnet-emerges-as-ddos-for-hire.html #IoTSec #DDoS

🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec

🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec

🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec

🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec

⚠️ CVE-2025-41108 (CRITICAL): Ghost Robotics Vision 60 v0.27.2 lets attackers hijack robots by spoofing control commands over MAVLink (no auth/encryption). Segment networks & monitor traffic while awaiting patch. https://radar.offseq.com/threat/cve-2025-41108-cwe-287-improper-authentication-in--fef464fa #OffSeq #CVE202541108 #Robotics #IoTSec

⚠️ CVE-2025-41108 (CRITICAL): Ghost Robotics Vision 60 v0.27.2 lets attackers hijack robots by spoofing control commands over MAVLink (no auth/encryption). Segment networks & monitor traffic while awaiting patch. https://radar.offseq.com/threat/cve-2025-41108-cwe-287-improper-authentication-in--fef464fa #OffSeq #CVE202541108 #Robotics #IoTSec

⚠️ CVE-2025-41108 (CRITICAL): Ghost Robotics Vision 60 v0.27.2 lets attackers hijack robots by spoofing control commands over MAVLink (no auth/encryption). Segment networks & monitor traffic while awaiting patch. https://radar.offseq.com/threat/cve-2025-41108-cwe-287-improper-authentication-in--fef464fa #OffSeq #CVE202541108 #Robotics #IoTSec

⚠️ CVE-2025-41108 (CRITICAL): Ghost Robotics Vision 60 v0.27.2 lets attackers hijack robots by spoofing control commands over MAVLink (no auth/encryption). Segment networks & monitor traffic while awaiting patch. https://radar.offseq.com/threat/cve-2025-41108-cwe-287-improper-authentication-in--fef464fa #OffSeq #CVE202541108 #Robotics #IoTSec

⚠️ CVE-2025-41108 (CRITICAL): Ghost Robotics Vision 60 v0.27.2 lets attackers hijack robots by spoofing control commands over MAVLink (no auth/encryption). Segment networks & monitor traffic while awaiting patch. https://radar.offseq.com/threat/cve-2025-41108-cwe-287-improper-authentication-in--fef464fa #OffSeq #CVE202541108 #Robotics #IoTSec

In the #iotsec front, here's a new package to play with, involving #mud (manufacturer usage descriptions) and RFC 8520. mudcerts (https://github.com/iot-onboarding/mudcerts) is a Go package that can generate a demo CA, signer cert, and #IEEE 802.1AR cert, as well as verify it.

In the #iotsec front, here's a new package to play with, involving #mud (manufacturer usage descriptions) and RFC 8520. mudcerts (https://github.com/iot-onboarding/mudcerts) is a Go package that can generate a demo CA, signer cert, and #IEEE 802.1AR cert, as well as verify it.

In the #iotsec front, here's a new package to play with, involving #mud (manufacturer usage descriptions) and RFC 8520. mudcerts (https://github.com/iot-onboarding/mudcerts) is a Go package that can generate a demo CA, signer cert, and #IEEE 802.1AR cert, as well as verify it.

In the #iotsec front, here's a new package to play with, involving #mud (manufacturer usage descriptions) and RFC 8520. mudcerts (https://github.com/iot-onboarding/mudcerts) is a Go package that can generate a demo CA, signer cert, and #IEEE 802.1AR cert, as well as verify it.

In the #iotsec front, here's a new package to play with, involving #mud (manufacturer usage descriptions) and RFC 8520. mudcerts (https://github.com/iot-onboarding/mudcerts) is a Go package that can generate a demo CA, signer cert, and #IEEE 802.1AR cert, as well as verify it.

Hypponen's Law ( @mikko ) confirmed (again):

"At the Usenix Workshop on Offensive Technologies earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear."

Citation:
https://www.wired.com/story/shimano-wireless-bicycle-shifter-jamming-replay-attacks/z

#iot #infosec #cybersecurity #IoTSec

Hypponen's Law ( @mikko ) confirmed (again):

"At the Usenix Workshop on Offensive Technologies earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear."

Citation:
https://www.wired.com/story/shimano-wireless-bicycle-shifter-jamming-replay-attacks/z

#iot #infosec #cybersecurity #IoTSec

Hypponen's Law ( @mikko ) confirmed (again):

"At the Usenix Workshop on Offensive Technologies earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear."

Citation:
https://www.wired.com/story/shimano-wireless-bicycle-shifter-jamming-replay-attacks/z

#iot #infosec #cybersecurity #IoTSec

Hypponen's Law ( @mikko ) confirmed (again):

"At the Usenix Workshop on Offensive Technologies earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear."

Citation:
https://www.wired.com/story/shimano-wireless-bicycle-shifter-jamming-replay-attacks/z

#iot #infosec #cybersecurity #IoTSec

Hypponen's Law ( @mikko ) confirmed (again):

"At the Usenix Workshop on Offensive Technologies earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear."

Citation:
https://www.wired.com/story/shimano-wireless-bicycle-shifter-jamming-replay-attacks/z

#iot #infosec #cybersecurity #IoTSec

Dutch ethical hacker Wietse Boonstra discovered a critical vulnerability in solar panel systems that could have allowed disruption of 4 million systems across 150 countries. The vulnerability affected systems made by Enphase, an American company. Boonstra found a flaw that allowed him to become an administrator of multiple accounts without permission.

Sources:

1. Dutch Institute for Vulnerability Disclosure (DIVD) report: https://www.divd.nl/newsroom/articles/divd-responsibly-discloses-six-new-zero-day-vulnerabilities-to-vendor/

2. Original reporting from Follow the Money (FTM), a Dutch investigative outlet: https://archive.is/BVR80

3. Euractiv summary article (English): https://www.euractiv.com/section/energy-environment/news/hacker-shines-spotlight-on-vulnerability-of-solar-panels-installed-in-europe/

#infosec #cybersecurity #renewableenergy #ethicalhacking #iotsec

Dutch ethical hacker Wietse Boonstra discovered a critical vulnerability in solar panel systems that could have allowed disruption of 4 million systems across 150 countries. The vulnerability affected systems made by Enphase, an American company. Boonstra found a flaw that allowed him to become an administrator of multiple accounts without permission.

Sources:

1. Dutch Institute for Vulnerability Disclosure (DIVD) report: https://www.divd.nl/newsroom/articles/divd-responsibly-discloses-six-new-zero-day-vulnerabilities-to-vendor/

2. Original reporting from Follow the Money (FTM), a Dutch investigative outlet: https://archive.is/BVR80

3. Euractiv summary article (English): https://www.euractiv.com/section/energy-environment/news/hacker-shines-spotlight-on-vulnerability-of-solar-panels-installed-in-europe/

#infosec #cybersecurity #renewableenergy #ethicalhacking #iotsec

Dutch ethical hacker Wietse Boonstra discovered a critical vulnerability in solar panel systems that could have allowed disruption of 4 million systems across 150 countries. The vulnerability affected systems made by Enphase, an American company. Boonstra found a flaw that allowed him to become an administrator of multiple accounts without permission.

Sources:

1. Dutch Institute for Vulnerability Disclosure (DIVD) report: https://www.divd.nl/newsroom/articles/divd-responsibly-discloses-six-new-zero-day-vulnerabilities-to-vendor/

2. Original reporting from Follow the Money (FTM), a Dutch investigative outlet: https://archive.is/BVR80

3. Euractiv summary article (English): https://www.euractiv.com/section/energy-environment/news/hacker-shines-spotlight-on-vulnerability-of-solar-panels-installed-in-europe/

#infosec #cybersecurity #renewableenergy #ethicalhacking #iotsec

Dutch ethical hacker Wietse Boonstra discovered a critical vulnerability in solar panel systems that could have allowed disruption of 4 million systems across 150 countries. The vulnerability affected systems made by Enphase, an American company. Boonstra found a flaw that allowed him to become an administrator of multiple accounts without permission.

Sources:

1. Dutch Institute for Vulnerability Disclosure (DIVD) report: https://www.divd.nl/newsroom/articles/divd-responsibly-discloses-six-new-zero-day-vulnerabilities-to-vendor/

2. Original reporting from Follow the Money (FTM), a Dutch investigative outlet: https://archive.is/BVR80

3. Euractiv summary article (English): https://www.euractiv.com/section/energy-environment/news/hacker-shines-spotlight-on-vulnerability-of-solar-panels-installed-in-europe/

#infosec #cybersecurity #renewableenergy #ethicalhacking #iotsec

Dutch ethical hacker Wietse Boonstra discovered a critical vulnerability in solar panel systems that could have allowed disruption of 4 million systems across 150 countries. The vulnerability affected systems made by Enphase, an American company. Boonstra found a flaw that allowed him to become an administrator of multiple accounts without permission.

Sources:

1. Dutch Institute for Vulnerability Disclosure (DIVD) report: https://www.divd.nl/newsroom/articles/divd-responsibly-discloses-six-new-zero-day-vulnerabilities-to-vendor/

2. Original reporting from Follow the Money (FTM), a Dutch investigative outlet: https://archive.is/BVR80

3. Euractiv summary article (English): https://www.euractiv.com/section/energy-environment/news/hacker-shines-spotlight-on-vulnerability-of-solar-panels-installed-in-europe/

#infosec #cybersecurity #renewableenergy #ethicalhacking #iotsec

@ted also, here's some people silently triggering voice commands with lasers

"Breaking Into a Smart Home With A Laser - Smarter Every Day 229"

https://www.youtube.com/watch?v=ozIKwGt38LQ

#SmarterEveryDay #IoT #IoTSec