Search: “device-integrity”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Policy & legal 2 AI tools & infra 1

SeverityAll critical 0 high 0 medium 0 low 2 info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Understanding the Security Boundary of Obfuscation-based On-Device LLM Protection

Researchers formalize obfuscation primitives for TEE-protected on-device LLMs and show a Collapse attack breaks ArrowCloak, TSQP, and LoRO, then extend the boundary.

The paper formalizes obfuscation primitives for TEE-Shielded LLM Partition (TSLP) schemes that offload computationally intensive layers from a Trusted Execution Environment to external GPUs. A novel primitive-guided attack, Collapse, demonstrates a shared vulnerability in prominent published methods including ArrowCloak (Security'25), TSQP (S&P'25), and LoRO (NeurIPS'25). The authors then introduce two new obfuscation primitives and integrate them with existing constructs to formulate an extended security boundary (O_ext).

arXiv cs.CRSep 9, 12:51 UTC · 6d agoAI safety & security

Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software

Position paper proposes hierarchical software quality assurance to characterize and secure EV charging station software attack surfaces.

The authors argue that charging station supply-equipment software is a largely unprotected and poorly characterized attack surface in EV charging infrastructure. They advocate applying hierarchical software quality assurance (HSQA) to this specialized software, spanning from individual vulnerabilities such as CVEs to high-level characteristics like the CIA Triad. HSQA embeds quality and security considerations across the entire software development lifecycle to assess and improve charging station software security.

arXiv cs.CRSep 9, 17:37 UTC · 6d agoResearch

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CRSep 9, 07:03 UTC · 7d agoResearch

Xiiaozet LK100W

CISA warns of three flaws, including OS command injection, in Xiiaozet LK100W devices before firmware 2.1.240 that allow attackers to take full control of the device.

CISA published ICS advisory ICSA-26-239-01 covering three vulnerabilities (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943) in Xiiaozet LK100W devices running firmware below 2.1.240. The issues include OS command injection, missing authentication for critical functions, and authentication bypass via an alternate path, rated CVSS v3 9.8. Successful exploitation allows an attacker to take control of the device. The China-based vendor's equipment is deployed worldwide, including information technology critical infrastructure sectors.

CISA AdvisoriesAug 27, 12:00 UTC · 20d agoAdvisory CVE-2026-78037 CVE-2026-78239 CVE-2026-76943

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42Aug 19, 12:05 UTC · 28d agoResearch

CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives

CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.

CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.

arXiv cs.CRSep 9, 15:44 UTC · 6d agoResearch1

[hardware] Fullhan FH8626V100 - Multiple Vulnerabilities

Multiple vulnerabilities in the Fullhan FH8626V100 hardware chip have been disclosed alongside public proof-of-concept exploits.

Exploit-DB lists an entry covering multiple vulnerabilities in the Fullhan FH8626V100, a hardware component. The listing provides no CVE ids, vulnerability classes, or evidence of in-the-wild exploitation. Impact is likely limited to devices embedding the affected chip.

Exploit-DBSep 2, 00:00 UTC · 14d agoExploit / PoC

[Control Systems] National Instruments security advisory (AV26-856)

Canada's Cyber Centre relayed National Instruments advisories for memory corruption, out-of-bounds read, and out-of-bounds write flaws in LabVIEW versions.

The Canadian Centre for Cyber Security published control systems advisory AV26-856 covering National Instruments LabVIEW. Affected versions include releases before 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1. The flaws include memory corruption, an integer conversion out-of-bounds read, and an integer overflow out-of-bounds write. Users and administrators are urged to review the links and apply NI security updates.

Canadian Centre for Cyber SecurityAug 28, 12:16 UTC · 18d agoAdvisory

Cisco searched for IOS XR bugs and found so many it rolled them into an update release

Cisco patched three critical flaws, including CVE-2026-20212 unauthenticated remote root code execution in Nexus 9000 switches; no exploitation observed yet.

Cisco disclosed three critical-rated flaws found during a comprehensive internal security review. CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, affect the IOS XR carrier-grade operating system and are fixed in newly released versions. CVE-2026-20212 lets unauthenticated remote attackers execute code with root privileges on some Nexus 9000 Series Switches by reaching TCP ports 43210 and 43211 in the default Layer 3 VRF; no software fix exists yet, only infrastructure ACL mitigations. Cisco says it has not observed attacks against these flaws.

The Register · SecuritySep 4, 02:18 UTC · 12d agoVulnerability CVE-2026-20274 CVE-2026-20279 CVE-2026-20212

ZDI-26-565: Gen Digital CCleaner Link Following Local Privilege Escalation Vulnerability

A link-following flaw (CVE-2026-12410, CVSS 7.8) in Gen Digital CCleaner allows local privilege escalation after low-privileged code execution.

ZDI advisory ZDI-26-565 details a link following vulnerability in Gen Digital CCleaner that permits local privilege escalation. An attacker must first be able to run low-privileged code on the affected installation. ZDI rated the issue 7.8 on CVSS and assigned CVE-2026-12410.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-12410

ZDI-26-558: (Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

ZDI disclosed a Pwn2Own certificate validation flaw (CVSS 6.8) in Amazon Smart Plug's OTA process, allowing network-adjacent attackers to bypass update verification.

The Zero Day Initiative published ZDI-26-558 for an improper certificate validation flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Network-adjacent attackers need no authentication to bypass certificate validation for over-the-air updates. ZDI rated the issue CVSS 6.8.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

Arbitrary process termination from exposed minifilter communication port

Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.

Fortinet advisory FG-IR-26-165 discloses an unverified ownership vulnerability (CWE-283, CVSSv3 4.7) in the FortiClient Windows fortimon3 minifilter driver. An authenticated attacker can terminate arbitrary processes through an exposed minifilter communication port. The advisory was revised on 2026-09-08.

Fortinet PSIRTSep 8, 07:00 UTC · 8d agoAdvisory1

Ebyte NA111-M

CISA reports 13 vulnerabilities, including CVSS 9.8 missing-authentication flaws, in Ebyte NA111-M firmware that allow full device compromise.

CISA published ICS advisory ICSA-26-239-05 for Ebyte NA111-M firmware 9013-2-17, listing 13 vulnerabilities tracked from CVE-2026-73125 through CVE-2026-77977. The issues include missing authentication for critical functions, GET requests with sensitive query strings, cross-site request forgery, improper restriction of excessive authentication attempts, and missing authorization. The vendor-assessed CVSS v3 score is 9.8, and successful exploitation could allow an attacker to fully compromise the device. No remediation details are included in the summary text.

CISA AdvisoriesAug 27, 12:00 UTC · 20d agoAdvisory CVE-2026-73125 CVE-2026-76179 CVE-2026-75814+10 CVEs

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.

The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19774

"They don't care about this": A Systematic Study of TEE Build Reproducibility in the Wild

91% of 115 surveyed TEE deployments across Intel SGX, TDX, and AMD SEV fail to provide reproducible builds needed for verifiable remote attestation.

A systematic study of 115 TEE deployments found 91% were not reproducible and 80% lacked both source code and a reference build, undermining remote attestation guarantees. Interviews with 12 developers of 50 Intel SGX projects confirmed that only one participant treats reproducibility as a development priority. The authors identify technical barriers such as embedded timestamps plus ecosystem-level issues like lack of build-environment control in multi-stakeholder projects, and call for holistic, committed reproducibility practices.

arXiv cs.CRSep 10, 11:43 UTC · 6d agoResearch

Cisco RoomOS Stack Overflow Vulnerability

Cisco fixed a stack overflow in the RoomOS USB driver allowing physical-access attackers to execute code with root privileges.

Insufficient boundary checks in the USB driver of Cisco RoomOS allow a buffer overflow when specific data is supplied through the USB port. An unauthenticated local attacker with physical access can connect a malicious USB device and execute arbitrary code with root privileges. Cisco has released software updates and no workarounds address the issue.

Cisco Security AdvisoriesAug 19, 16:00 UTC · 27d agoAdvisory

Rockwell Automation 1756-ENBT Module

Rockwell's 1756-ENBT ControlLogix EtherNet/IP bridge (all versions) is vulnerable to DoS via crafted CIP packets, crashing the module until manual restart.

CISA republished Rockwell Automation's advisory for CVE-2025-10478, a CWE-754 flaw affecting all versions of the 1756-ENBT ControlLogix EtherNet/IP bridge, scored CVSS 7.5. A crafted CIP packet can crash the module, and the device requires a restart to recover. Affected critical infrastructure sectors include critical manufacturing, food and agriculture, transportation systems, and water. No public exploitation has been reported; CISA recommends minimizing network exposure.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory 3 sources CVE-2025-10478

ZDI-26-580: Cisco Identity Services Engine Missing Authentication for Critical Function Information Disclosure Vulnerability

ZDI discloses CVE-2026-20190, a missing-authentication flaw in Cisco Identity Services Engine permitting unauthenticated sensitive information disclosure, rated CVSS 7.5.

ZDI-26-580 covers a missing authentication for critical function flaw in Cisco Identity Services Engine. Unauthenticated remote attackers can disclose sensitive information from affected installations. The vulnerability is tracked as CVE-2026-20190 and rated CVSS 7.5. The advisory does not indicate exploitation in the wild.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-20190

VU#874418: RDK-B WebUI contains multiple vulnerabilities

CERT/CC warns RDK-B WebUI rdkb-2025q4-kirkstone contains multiple flaws enabling network attackers to bypass authentication, cause DoS, or potentially execute code.

VU#874418 describes multiple vulnerabilities in the RDK-B WebUI version rdkb-2025q4-kirkstone, the open-source Reference Design Kit for Broadband used in broadband gateways and networking devices. Issues include memory corruption, improper authentication, race conditions, and insufficient input validation. A network-adjacent attacker could bypass authentication, obtain administrative access, cause denial-of-service, or corrupt underlying processes, with potential arbitrary code execution under certain conditions.

CERT/CC Vulnerability NotesAug 19, 19:28 UTC · 27d agoVulnerability

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-38059 CVE-2026-38057 CVE-2026-38056+1 CVEs

ZDI-26-563: (Pwn2Own) Home Assistant Green Simple Service Discovery Protocol Server-Side Request Forgery Vulnerability

ZDI disclosed a Pwn2Own SSRF flaw (CVSS 5.4) in Home Assistant Green's SSDP server, letting unauthenticated network-adjacent attackers trigger arbitrary server-side requests.

The Zero Day Initiative published ZDI-26-563 for a server-side request forgery in the Simple Service Discovery Protocol server on Home Assistant Green. The bug was demonstrated at Pwn2Own and allows network-adjacent, unauthenticated attackers to initiate arbitrary server-side requests on affected installations. ZDI rated the issue CVSS 5.4.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

Hack One Robot, Reach the Next: Unitree G1 Security Flaws

Researcher chained two Unitree G1 flaws (CVE-2026-76639, CVE-2026-76640) to gain unauthenticated root access, with compromised robots able to infect others via Bluetooth.

Security researcher Olivier Laflamme chained a path-traversal file-write flaw (CVE-2026-76639) in the G1 chatbot service and a Bluetooth server buffer overflow (CVE-2026-76640) to achieve unauthenticated root access remotely. The chain abuses Unitree's cloud API as a decryption oracle for the AES-128 key that unlocks BLE and WebRTC channels, and a compromised robot can propagate the attack to nearby G1 units. Unitree patched the cloud ownership-check flaw, paid a $5,000 bounty, and firmware fixes for BLE pairing and the buffer overflow remain harder to deliver.

Security AffairsAug 29, 11:55 UTC · 18d agoVulnerability CVE-2026-76639 CVE-2026-76640

Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch

Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.

Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.

CSO OnlineSep 9, 02:22 UTC · 7d agoVulnerability CVE-2026-20274 CVE-2026-20279

USN-8727-1: Linux kernel (OEM) vulnerabilities

Ubuntu issued kernel security update USN-8727-1 for OEM kernels, fixing an Arm TLB invalidation flaw (CVE-2025-10263) allowing local privilege escalation.

Ubuntu released USN-8727-1, a security update for the OEM variant of the Linux kernel. It fixes CVE-2025-10263, in which certain Arm processors complete broadcast TLB invalidation before related memory writes are globally observed, potentially letting local attackers bypass memory protections or escalate privileges. The notice also corrects additional kernel flaws across ARM64, ARM32, RISC-V, S390 and other subsystems.

Ubuntu Security Noticesupdated Sep 7, 09:12 UTC · 9d agofirst Sep 7, 09:02 UTC · 9d agoAdvisory 6 sources CVE-2025-10263

ZDI-26-564: NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

ZDI discloses CVE-2026-24232, a CVSS 7.8 deserialization RCE in NVIDIA Transformers4Rec's load_model_trainer_states_from_checkpoint function.

The Zero Day Initiative published ZDI-26-564, a deserialization of untrusted data vulnerability in NVIDIA Transformers4Rec. Remote code execution is possible, but exploitation requires user interaction such as visiting a malicious page or opening a malicious file. The flaw is tracked as CVE-2026-24232 with a CVSS score of 7.8.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Advisory CVE-2026-24232

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Autonomous penetration testing advocates prioritize exploitable attack paths over raw vulnerability severity for continuous security validation.

The article argues that scanner severity scores lack context: a critical flaw behind strong segmentation may be low priority, while a medium flaw on internet-facing systems can provide a foothold chained toward sensitive data. It positions autonomous penetration testing and attack path validation as the execution layer for continuous security validation, replacing point-in-time assessments. The piece is vendor-authored thought leadership rather than incident or vulnerability news.

The Hacker NewsSep 11, 11:30 UTC · 5d agoIndustry1

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker NewsSep 2, 07:47 UTC · 14d agoResearch CVE-2021-318862

ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.

ZDI-26-527 describes a deserialization of untrusted data flaw in Wazuh's cluster DAPI protocol allowing network-adjacent attackers to execute arbitrary code. Exploitation requires the attacker to first obtain low-privileged code execution on a worker node. ZDI assigned a CVSS score of 9.9, and the flaw is tracked as CVE-2026-44901.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-44901

Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability

Cisco patches unauthenticated RCE in Nexus 9000 Silicon One switches exposed via TCP ports 43210 and 43211 in the default L3 VRF.

Cisco disclosed and patched a vulnerability in the Silicon One integration for Nexus 9000 Series switches that allows an unauthenticated remote attacker to execute code with root privileges. The flaw stems from TCP ports 43210 and 43211 being accessible in the default Layer 3 VRF. Exploitation can also crash the S1HAL process and force an affected device to reload. Cisco has released software updates, and workarounds are available to mitigate exposure.

Cisco Security AdvisoriesSep 2, 16:00 UTC · 13d agoVulnerability

UNISOC Modem Flaw Enables Remote Code Execution via Video Calls

A UNISOC modem flaw allows attackers to achieve kernel-level remote code execution through malicious video calls on affected devices.

UNISOC, whose modems are widely deployed in Android smartphones, has a flaw that enables kernel-level code execution triggered via video calls. Successful exploitation would give an attacker deep control over affected handsets. No exploitation activity is mentioned in the report.

Infosecurity MagazineAug 17, 15:45 UTC · 29d agoVulnerability