wake-and-break
blasty/wake-and-breakPSP exploit for AMD navi31 (RX 7900) GPUs that disables firmware signature checks so the card loads unsigned SMU, SDMA, MEC, IMU and RLC firmware;…
embedded-systems-securityexploitationfirmware-analysis+5
6
blasty/wake-and-breakPSP exploit for AMD navi31 (RX 7900) GPUs that disables firmware signature checks so the card loads unsigned SMU, SDMA, MEC, IMU and RLC firmware;…
synacktiv/samsung-q60t-exploitExploit suite targeting Tizen-based Samsung Q60T TV, including v8 and kernel exploits, firmware decryption, and root shell access via payload…
zb3/tiandy-researchThis repository contains the results of my August 2020 research of Tiandy's IPC/NVR firmware. I found two vulnerabilities that could be used to…
ebux/cable-modemsBlack-box security evaluation of five ISP cable modem/router gateways, analyzing firmware images and documenting 35+ vulnerabilities including…
yasindce1998/barzakhRing -4 to Ring 0: offense-defense firmware research platform. We build the bootkits, then we catch them. Closed-loop. Zero trust in silicon.
cplusplus17/deco-filepush-disclosureDisclosure and PoC for a root file read/write flaw in the TP-Link Deco XE75 Pro V3 debug channel (tmpsvr opcodes 0xC456/0xF0), with CVSS analysis and…
themalwareguardian/uefi-security-research-howyar-sysreturn-netcopyPost CVE-2024-7344 analysis of Howyar SysReturn NetCopy - reverse engineering notes, vulnerable binaries, vendor correspondence, and proof-of-concept…
hackspeak/cve-2026-94095PoC for CVE-2026-94095, a traceroute command injection in Netcore NBR200V2 firmware via ubus JSON-RPC, enabling root RCE for authorized testing.
hackspeak/cve-2026-93958Authenticated command injection PoC for D-Link R95/BE9500 DHMAPI SetTimeSettings, achieving root RCE via NTPServer backtick injection, with full…
newbe3e/pwn2own-automotive-2026-alpine-ilx-f511-0-click-rce-exploit-writeupWriteup of a 0-click remote code execution exploit chain developed for the Alpine iLX-F511 automotive head unit at Pwn2Own Automotive 2026.
nccgroup/thingernet-graphPython script to generate neo4j Cypher representation of a collection of IoT devices for visualisation and query.
turretsec/disclosure-thinkware-u3000Three unauthenticated vulnerabilities in the Thinkware U3000 dashcam's local WiFi control protocol: arbitrary file write, arbitrary file read, and…
turretsec/u3000pyPython client for the Thinkware U3000 dashcam's local WiFi control protocol, reverse-engineered from the official Android app. PoC tooling behind…
nccgroup/powerg-toolsTools for reverse engineering and interacting with the PowerG radio protocol
themalwareguardian/cve-2022-34302Demonstrates CVE-2022-34302, a Secure Boot bypass via the New Horizon Datasys signed bootloader whose built-in custom PE/COFF loader executes…
harshrajsinghania/cve-2026-86547-mrubyc-op-enterStandalone proof of concept for CVE-2026-86547, a NULL pointer dereference in mrubyc op_enter() through 4.0.0.
snyi001/cve-2026-79551-tendaTenda Technology Co., Ltd NVR_4H: CH3 v2.1.V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
jihoonjang98/hqc-x86-simdOptimized HQC post-quantum KEM implementations for AVX2 and AVX-512 with GFNI, plus a unified benchmarking and NIST KAT suite for x86 IoT gateways.