Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
6 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_350d40f2cc69277bcaRecent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
An attacker sending malformed miIO messages over WiFi to a Xiaomi Smart camera device can trigger the vulnerability described here. This report describes a secure protocol design issue, which leads to authentication bypass in the proprietary Xiaomi miIO protocol. The vulnerability described in this advisory affects a potentially wide range of Xiaomi Smart devices. This vulnerability has not yet been issued a public patch or advisory or assigned a CVE by the vendor despite repeated requests and a lapse of more than six months since the original vendor disclosure. Vulnerability Details For packets received in UDP port 54321, the miio_client binary verifies the MAC and then decrypts the received packet.
First reported Mar 16, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Summary Due to a race condition in input validation, the SCrypto implementation of the drTima secure driver (uuid ffffffffd0000000000000000000000a) was susceptible to a buffer overflow. The drTima secure driver implements a fully featured crypto engine entirely in software, called SCrypto. The SCrypto APIs are callable by all Trustlets without restriction. SCrypto is in fact the OpenSSL’s FIPS compliant library with an abstraction layer added to facilitate the same APIs for crypto operations that are present between Trustlets and Secure Drivers. The SCrypto command implements three kinds of functions: hashing (MD function family), encryption/decryption (3DES, AES, RSA), and signing (RSA). The race condition vulnerability is in the ciphering command implementation of RSA encryption.
First reported Mar 02, 2018 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a heap buffer overflow, which leads to remote code execution. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 contains this vulnerability as CVE-2026-34119. Vulnerability Details another overflow similar to CVE-2026-34118 was present within the main HTTP parser function. This vulnerability can be triggered when more than one receive is required to read the full contents of the body.
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Summary Due to missing input validation, the SCrypto implementation of the drTima secure driver (uuid ffffffffd0000000000000000000000a) was susceptible to a buffer overflow. The drTima secure driver implements a fully featured crypto engine entirely in software, called SCrypto. The SCrypto APIs are callable by all Trustlets without restriction. SCrypto is in fact the OpenSSL’s FIPS compliant library with an abstraction layer added to facilitate the same APIs for crypto operations that are present between Trustlets and Secure Drivers. The SCrypto command implements three kinds of functions: hashing (MD function family), encryption/decryption (3DES, AES, RSA), and signing (RSA). For each type, there are two types of implementations:
First reported Mar 01, 2018 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
There is a memory management and a path traversal vulnerability in the vision DSP kernel driver of Exynos S20 devices. These vulnerabilities can be leveraged by a malicious untrusted application to permanently disable the device until it is factory reset. Vulnerability Details The Exynos DSP driver implements an ioctl call that allows applications to upload a custom model (graph) for the dsp device. The DSP_IOC_LOAD_GRAPH ioctl handler of the /dev/dsp device receives an array of names of the graph binaries to be loaded. The dsp_kernel_alloc function appends the “.elf” extension to the user-supplied name then uses the kernel’s request firmware API to load it from the file system.
First reported Dec 14, 2021 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Summary This is the first part of a blog series about reverse engineering and exploiting Samsung’s TrustZone. Following parts in the series so far: 2, 3. This first post covers the basics of the architecture. All of this is public info, nothing new, all of it has been covered in bits and pieces in various publications before. Some of it comes from Trustonic/Samsung materials, some of it from open source software, and some of it from the few great instances of prior research. It’s here as an intro, for completeness. Later in the series, I summarize the reverse engineering results and explain the vulnerabilities that I have found.
First reported Jan 28, 2018 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is DoS in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulnerability Details Crash happens due to a NULL access. int sdp_msg_unpack_bandwidth(char **param_1,undefined *param_2) { iVar2 = sdp_msg_unpack_string_list.constprop.26(param_1,0x62,-1,(undefined *)&uStack_1c); if (iVar2 == 0) { puVar7 = &uStack_1c; local_20 = (char *)0x0; while ((char *)puVar7[1] != (char *)0x0) { puVar3 = (uint *)voip_strtok_r((char *)puVar7[1],":",&local_20); // [1] *(undefined4 *)(param_2 + 4) = 0; bVar1 = sdp_msg_unpack_type(5,5,-0x6e41ac2c,puVar3,(int *)(param_2 + 4),(uint **)0x0); .
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending malformed requests over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a cryptographic design vulnerability, which enables offline password bruteforce, which may leads to TAPO cloud account compromise. The vulnerability we are disclosing in this advisory affects a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory has not yet been released for this vulnerability. Vulnerability Details The following diagram summarizes the TAPO camera authentication procedure: First, the client queries the acn, then calculates the digest password the following way: H(cnonce + H(pw) + acn) + acn + cnonce The device_confirm value contains the hashed password to prove the identity of the device to the app (or other party), as follows: H(cnonce + H(pw) + acn) + acn + cnonce = device_confirm.
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
We have identified a new heap buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in Android in the radio context. The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chipsets. The July 2023 issue of the Samsung Mobile Security Bulletin contains this vulnerability as CVE-2023-30649. Vulnerability Details The Exynos vendor RIL implementation, provided by the libsec-ril.so library, exposes an Inter Process Call (IPC) interface to the baseband processor. The baseband processor can use this API through dedicated IPC messages.
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
We have identified a new heap buffer overflow vulnerability in Samsung’s baseband implementation (mainly used in Exynos chipsets). The vulnerability can be exploited to achieve arbitrary code execution in the baseband runtime. The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chipsets. The June 2023 issue of the Samsung Mobile Security Bulletin contains this vulnerability as CVE-2023-21517. Vulnerability Details Layer 3 LTE NAS messages are composed of various Information Elements and the Exynos modem implementation defines dedicated parser functions for each IE type. The vulnerability is within the parser function of the Traffic Flow Template IE (3GPP TS 24.
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is DoS in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulnerability Details Crash happens due to a NULL access. The crash happens in sdp_msg_create_negotiation_sdp. It is caused by a malformed audio attribute for RTP/AVP resulting in a NULL pointer access, which crashes the modem. Example payload The following SIP messages were tested:
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
There is a sensitive information disclosure vulnerability in the vision DSP kernel driver of S20 Exynos devices. The vulnerability can be used by malicious privileged applications to read the kernel’s and other application’s memory. Vulnerability Details The Exynos DSP driver implements an ioctl call that allows applications to upload a custom model (graph) for the dsp device. The DSP_IOC_LOAD_GRAPH ioctl handler of the /dev/dsp device receives an array of Unix paths of the graph files to be loaded. This array has a complex structure, it begins with an array of integers that contains the length of each path. The array of lengths is followed by the actual path strings, one after the other, delimited by the length values.
First reported Dec 14, 2021 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Summary In this advisory we are disclosing a vmap/vmalloc use-after-free vulnerability within the Android ION allocator, that impacts most Android devices that utilize ION. The exploitability of the vulnerability depends on how the various kernel drivers use the allocated ION buffers, the version of the kernel and the vendor specific modifications to the ION subsystem. In the most serious cases the vulnerability can be used to corrupt vmallocated kernel buffers, including kernel stacks, to achieve kernel code execution and compromise the integrity of the kernel. The ION allocator went over multiple refactors throughout its evolution, yet the vulnerability persisted within the Android common and the Linux upstream kernel branches.
First reported Sep 22, 2021 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a stack buffer overflow, which leads to denial of service and may potentially lead to remote code execution. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 contains this vulnerability as CVE-2026-34124. Vulnerability Details We identified a stack buffer overflow vulnerability in the way te HTTP server of TAPO devices handles GET requests. http_parser() { path = .
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
We have identified a new heap buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in Android in the radio context. The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chipsets. The July 2023 issue of the Samsung Mobile Security Bulletin contains this vulnerability as CVE-2023-30647. Vulnerability Details The Exynos vendor RIL implementation, provided by the libsec-ril.so library, exposes an Inter Process Call (IPC) interface to the baseband processor. The baseband processor can use this API through dedicated IPC messages.
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is Heap Overflow in the baseband, triggered by malformed multipart SIP messages containing SMS data. The vulnerability described in this advisory affected a wide range of Mediatek devices. The January 2024 issue of the Mediatek Security Bulletin contains this vulnerability as CVE-2023-32886. Vulnerability Details SIP supports the processing of multipart requests (as described in RFC 1341), where a single message can contain multiple body parts, with different content type. In these messages each body fragment is separated by a boundary tag, that is defined in the boundary parameter of the Content-Type MIME header.
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Summary Due to a bug in the way mappings are closed it is possible to free a kmallocated memory chunk arbitrary times. This vulnerability can be used to craft a use after free scenario against any kernel structure that is allocated from the kmalloc-64 cache. There is rich public literature on how such use after free vulnerabilities can be utilized to compromise the kernel, achieve code execution in kernel context, and elevate privileges of user space processes. Even when modern mitigation is deployed. The mmap handler is exposed through the /dev/davinci0 character device. Due to the applied selinux policy, access to this device is restricted to the hiaiserver system process.
First reported Aug 02, 2021 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
We have written extensively about remote baseband vulnerability research in the past, examining various vendors’ baseband OS micro-architectures and exploring their implementations for remotely exploitable bugs. So have many others. One might say, our research exists in the context in which it lives and what came before it: whether it be about finding (1, 2, 3, 4, 5, 6, 7) or exploiting (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14) vulnerabilities. However, one area that has been absent from prior art was a direct examination of lower layers of Radio Layer protocols for security vulnerabilities.
First reported Jul 29, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is stack buffer overflow in the baseband, triggered by malformed SDP data in VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. The January 2024 issue of the Mediatek Security Bulletin contains this vulnerability as CVE-2023-32874. Vulnerability Details When a SIP message contains SDP data, first the cc_call_unpack_sdpmsg routine is invoked to unpack the message bytes into an internal representation (sdp_message_struct). Later the codec information is extracted from this internal representation by calling several codec extracting functions.
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Samsung’s neural processing framework has received a lot of attention from the security community since its introduction. Hardware isolation vulnerabilities have been demonstrated, both on the NPU and DSP cores (1, 2), that could be used to compromise the kernel. The surrounding kernel code was also exploited by multiple researchers to gain local privilege escalation (1, 2). I, too, explored in a previous blog post how a kmalloc overflow within the Samsung NPU kernel driver can be exploited to gain arbitrary kernel read/write access. As a follow up work, I’ve decided to investigate Huawei’s implementation of their neural processing framework. Despite being the second largest vendor on the Android market, recently there have been lot fewer technical papers published about the security of their devices.
First reported Jul 30, 2021 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Additional posts in this series: Part 1 Part 2 In my Basebanheimer talk at Hardwear.io, I explained a method for exploiting the Mediatek Baseband Pivot vulnerability CVE-2022-21765 for arbitrary code execution in the Linux kernel on Mediatek’s older (“Helio”) chipsets, which use 32-bit kernels. I also mentioned that using previous ideas, the vulnerability could theoretically be exploited on Mediatek’s newest chipset family (Dimensity, which uses 64-bit kernels) as well. After the conference, with my college Lorant Szabo we have completed this exercise. The vulnerabilities: CVE-2022-21765 and CVE-2022-21769 To recap, the vulnerabilities provide an OOB read/write in the Linux kernel driver that implements the Application (AP) and Cellular Processor (CP) interface, which Mediatek calls the CCCI driver.
First reported Dec 07, 2023 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
There are a series of memory corruption vulnerabilities in Samsung Exynos kernels, due to improper error checks, after dma_buf_vmap calls. These bugs can be abused by various privileged processes to cause NULL pointer accesses and crash the kernel. Vulnerability Details The kernel uses the dma_buf_vmap function if it needs to map a dma buffer into the kernel address space to access its content. This function returns a NULL pointer if it encounters an error during its execution. While some drivers employ a null check on the returned pointer, many call sites incorrectly use the IS_ERR macro which explicitly allows NULL pointers.
First reported Dec 13, 2021 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
Summary This is the second part of a blog series covering my security research into Samsung’s TrustZone. This post is a companion to my talk from Ekoparty 2017, namely the reverse engineering process of T-base. The slides and video of the talk are both available online. In fact, since both of those are available, for this part of the series I didn’t quite write a “storytelling” blog post. Instead, this post only does what the slide/video format does not accomplish: a more accessible enumeration of the most important results (code snippets, declarations of reversed functions/structures). So it’s more like a wiki then a blog post.
First reported Jan 29, 2018 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a stack buffer overflow, which leads to remote code execution. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 contains this vulnerability as CVE-2026-34122. Vulnerability Details There is an unsafe strcpy in the handler function of the set_park_config DS action of the HTTP server in TAPO devices: ds_set_park_config() { iVar1 = get_some_global(); if (iVar1 != 0) { memcpy(&local_48,(void *)(iVar1 + 0x10),0x38); action_mode = jso_obj_get_string_origin(root,"enabled"); if ((action_mode !
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 08:35 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.