All CosmicBytez Labs articles tagged #IoT Security, across news, security advisories, how-to guides, and projects.
CVE-2026-82448 (CVSS 9.8): a hardcoded key in Shinobi's child-node service lets attackers run arbitrary SQL against user and camera data.
CVE-2026-82452 (CVSS 9.8): rust-iot-platform's REST API lacks auth checks — anyone can create, edit, or delete accounts, no login required.
Researcher discloses two root RCE chains in the Unitree G1 EDU robot; one is a wormable, unauthenticated Bluetooth exploit reaching root remotely.
A critical flaw in UniFi Protect lets a low-privileged, network-adjacent attacker inject OS commands on the host device. Patch to 7.2.105+.
Every published Zbtlink router firmware build contains ENDLESSDOORS — an embedded root-level remote control implant disguised as a Linux kernel worker thread, giving attackers persistent backdoor access to the device.
A critical authentication bypass in Puwell IP Camera firmware 2.x through 4.x allows unauthenticated attackers to access live video streams, control pan/tilt/audio functions, and restart devices over the network with no credentials required.
A critical unauthenticated command injection vulnerability in Puwell IP Camera firmware 2.x through 4.x allows remote attackers to execute arbitrary OS commands as root via the device's exposed DebugShell interface on TCP port 34567. No patch is available.
LG Electronics USA announced it will suspend Smart TV apps that enroll viewers' televisions into residential proxy networks — a move triggered by research revealing that more than 42% of webOS games and apps were silently turning LG TVs into always-on proxy nodes without user knowledge or consent.
A critical authentication bypass in Apache IoTDB allows unauthenticated attackers to forge Thrift RPC session IDs and receive valid time-series query...
A critical path traversal vulnerability in Apache IoTDB's DataNode RPC interface allows unauthenticated attackers to write arbitrary files outside the...
A critical unauthenticated stack-based buffer overflow in thttpd on GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote attackers to execute...
A critical unauthenticated stack-based buffer overflow in the ssvr RTSP service of GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote attackers to...
A critical unauthenticated stack-based buffer overflow in GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote code execution by exploiting...
A critical unauthenticated stack-based buffer overflow in the vlsvr daemon of GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote code execution...
Canadian authorities arrested a 23-year-old Ottawa man suspected of building and operating Kimwolf, an IoT botnet that enslaved millions of devices for...
U.S. and Canadian authorities arrested and charged a Canadian man with operating the Kimwolf DDoS botnet, which infected nearly two million devices...
Claroty researchers have disclosed two vulnerabilities in the EnOcean SmartServer IQ building management controller that can be chained for security...
A critical OS command injection vulnerability in the Totolink A8000RU router allows remote attackers to execute arbitrary commands by manipulating the...
Threat actors are deploying the Nexcorium Mirai botnet variant by exploiting CVE-2024-3721 in TBK DVR devices and targeting end-of-life TP-Link Wi-Fi...
This week's ThreatsDay Bulletin from The Hacker News covers 20 active threats including a hybrid P2P DDoS botnet, a 13-year-old Apache ActiveMQ RCE flaw...
A critical unauthenticated information disclosure vulnerability in the Gardyn smart garden platform exposes all registered user account information via a...
A critical CVSS 9.3 stack-based buffer overflow in Grandstream GXP1600 series VoIP phones allows unauthenticated remote code execution, enabling attackers...