Search: “firmware”

9 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 21 Advisory 18 Research 15 Exploit / PoC 10 Malware 10 Threat actor 10 Policy & legal 5 AI safety & security 3 Data breach 3 Industry 3 AI research 1 Phishing & fraud 1 Tools 1

SeverityAll critical 5 high 31 medium 33 low 12 info 20

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42Aug 19, 12:03 UTC · 28d agoExploit / PoC in the wildCVE-2023-335381

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.

Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.

Security AffairsSep 11, 07:11 UTC · 5d agoExploit / PoC in the wildCVE-2026-154091

Critical Cisco Secure Email Gateway zero-day gives attackers root access

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.

CSO Onlineupdated 13:57 UTC · 4h agofirst Sep 15, 19:56 UTC · 22h agoExploit / PoC in the wild 17 sources CVE-2026-76461 CVE-2025-203931

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersSep 15, 05:20 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2024-21762 CVE-2020-1938

MikroTik patches flaws currently being exploited to take over routers

MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.

MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 for six vulnerabilities found by CERT Polska, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig. CVE-2026-67276, an RSA public-key validation flaw in the SSH server, lets an attacker who knows a username and key modulus authenticate as that user; CVE-2026-86060 then escalates privileges to root via special-character username handling. CERT Polska confirmed attackers are exploiting the chain to take full control of RouterOS devices with SSH exposed to the internet. Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.

CSO Onlineupdated Sep 11, 11:57 UTC · 5d agofirst Sep 9, 20:00 UTC · 6d agoExploit / PoC in the wild 3 sources CVE-2026-67276 CVE-2026-860602

[webapps] Linksys E1200_2.0.04 - Unauthenticated OS Command Injection

A proof-of-concept for unauthenticated OS command injection in Linksys E1200 router firmware 2.0.04 has been published on Exploit-DB.

Exploit-DB entry 52660 discloses an unauthenticated OS command injection affecting the Linksys E1200 wireless router running firmware version 2.0.04. The flaw is categorized as a web application vulnerability. No CVE identifier or evidence of in-the-wild exploitation is provided in the listing.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security Newsupdated 17:56 UTC · 56m agofirst 09:40 UTC · 9h agoExploit / PoC in the wild 8 sources CVE-2026-58704 CVE-2026-28662

CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks

CISA adds exploited Citrix NetScaler authentication bypass CVE-2026-19490 to the KEV catalog; federal agencies must patch by September 12.

CISA added CVE-2026-19490, a CWE-288 authentication bypass affecting NetScaler ADC and Gateway deployments configured as AAA virtual servers or Gateway services (including SSL VPN, ICA Proxy, and RDP Proxy), to the Known Exploited Vulnerabilities catalog. Citrix released fixes on August 19, 2026; honeypots recorded 56 attack attempts between September 3 and 8 after a public PoC, though no confirmed production compromises have been reported. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21; newer installations require SAML IdP configuration to be exposed.

Cyber Security Newsupdated Sep 10, 18:57 UTC · 5d agofirst Sep 10, 13:23 UTC · 6d agoExploit / PoC in the wild 5 sources CVE-2026-19490

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security AffairsAug 20, 17:36 UTC · 27d agoExploit / PoC in the wild