#IoT Security
All CosmicBytez Labs articles tagged #IoT Security, across news, security advisories, how-to guides, and projects.
- News
Hackers Hijack D-Link, Ubiquiti Devices to Resell Stolen Bandwidth
GreyNoise found 143 hijacked NAS, NVR, and SAP devices across 34 countries silently enrolled in the Pawns.app residential proxy network.
- Security
CVE-2026-110957: Critical OS Command Injection in Wavlink WL-WN530BE2-A Routers
A maximum-severity CVSS 10.0 flaw lets unauthenticated attackers run OS commands on Wavlink WL-WN530BE2-A routers via the REMOTE_ADDR parameter.
- Security
CVE-2026-108929: Netcore NR268 Router DDNS Argument Injection
A CVSS 9.9 argument injection flaw in Netcore NR268 router firmware lets remote attackers hijack the DDNS Hostname field to run arbitrary commands.
- Security
CVE-2026-108971: D-Link DCS-930L Firmware Signature Verification Bypass
A CVSS 9.6 flaw in D-Link DCS-930L cameras lets remote, unauthenticated attackers flash unsigned firmware via the recovery server.
- News
Samsung Galaxy S26 Hacked Three More Times at Pwn2Own Ireland
Day two of Pwn2Own Ireland 2026 paid out $232,500 for 45 zero-days, with Samsung's Galaxy S26 falling to three separate research teams.
- News
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
Researchers earned $388,500 after exploiting 32 zero-days on day one of Pwn2Own Ireland 2026, hitting the Samsung Galaxy S26 twice.
- Security
CVE-2026-101187: Ziroom ZHOME A0101 Command Injection via USB Device Management API
A high-privilege command injection flaw in Ziroom ZHOME A0101's USB Device Management API allows OS command execution via a crafted path argument.
- News
Read This Before You Buy That TV Streaming Stick
Bitsight researcher Pedro Fale traced 38,000+ H96 Android TV boxes secretly running ad fraud and residential-proxy malware for China's Fengwo Group.
- Security
CVE-2026-101000: Missing Authorization in Netcore NBR100V2 ACL Handler
Netcore NBR100V2's ACL handler skips authorization on uci.apply, letting unauthenticated attackers tamper with device configuration remotely.
- Security
CVE-2026-101001: Netcore NBR200V2 Web Management Interface OS Command Injection via network_tools
Unauthenticated OS command injection in Netcore NBR200V2's network_tools CGI handler via QUERY_STRING gives remote attackers root-level code execution.
- Security
CVE-2026-101002: Netcore NBR200V2 Tools Ping Handler OS Command Injection
Netcore NBR200V2's Ping diagnostic tool injects an unsanitized url argument into a system() call, enabling remote command injection.
- Security
CVE-2026-95699: iSteamX Mobile App AWS IoT Policy Exposes Connected Device Data
A misconfigured AWS IoT policy in the iSteamX app let users reach wildcard MQTT topics, exposing other users' devices and profile data.
- News
D-Link Warns of Max Severity Zero-Day Bug in DIR-822A Routers
D-Link disclosed two unpatched flaws in legacy DIR-822A routers with public PoC exploit code, including a max-severity DHCP stack overflow.
- Security
CVE-2026-94089: Critical Unauthenticated Stack Overflow in D-Link DIR-868L Routers
A CVSS 10 stack-based buffer overflow in D-Link DIR-868L's authentication CGI lets unauthenticated remote attackers achieve full router compromise.
- Security
CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
An unauthenticated command injection in Netcore NBR200V2's traceroute tool lets attackers run arbitrary commands as root via ubus JSON-RPC.
- Security
CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
Netcore NBR200V2 routers are vulnerable to unauthenticated command injection via the ipv4 argument in the LAN IP configuration handler.
- Security
CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
A third command injection flaw in Netcore NBR200V2's network_tools CGI endpoint lets remote attackers run arbitrary shell commands unauthenticated.
- Security
CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
Netcore NBR200V2's firmware upgrade CGI endpoint injects the QUERY_STRING argument into a shell command, enabling unauthenticated remote injection.
- Security
CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
The restore.cgi backup-restore endpoint on Netcore NBR200V2 routers is vulnerable to unauthenticated command injection via QUERY_STRING.
- Security
CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration
A buffer overflow in Netcore NBR200V2's routerd WAN VLAN handler can be triggered remotely via the vlan_wanX.ports argument.
- Security
CVE-2026-93958: D-Link R95 (BE9500) Command Injection to Root RCE
A public PoC chains D-Link R95 BE9500 firmware 1.00.16's SetTimeSettings handler into authenticated command injection for root shell access.
- Security
Totolink A3002MU Router Buffer Overflow Enables Remote Attacks
CVE-2026-93741 (CVSS 10) lets remote attackers overflow a buffer in the Totolink A3002MU's web admin interface. Public exploit code, no patch yet.
- Security
CVE-2026-90699: D-Link DWR-M920 OS Command Injection via PIN Manage Setup
D-Link DWR-M920 1.1.7 lets remote attackers inject OS commands through the formPinManageSetup handler; a public exploit is already available.
- Security
CVE-2026-90702: D-Link DWR-M921 OS Command Injection via Disk Format Handler
D-Link DWR-M921 1.1.52 lets remote attackers inject OS commands through the formDiskFormat handler; a public exploit is already available.
- Security
CVE-2026-90703: D-Link DWR-M921 OS Command Injection via Disk Share Handler
D-Link DWR-M921 1.1.52 lets remote attackers inject OS commands through the formDiskCreateShare handler; a public exploit is already available.
- Security
CVE-2026-86148: Tenda CP3 OS Command Injection via AlarmVoiceURL
A critical unauthenticated OS command injection flaw in Tenda CP3 Wi-Fi cameras lets remote attackers run arbitrary commands via the AlarmVoiceURL parameter.
- Security
CVE-2026-86149: Tenda CP3 OS Command Injection via NetCheckPing
A second critical command injection flaw in Tenda CP3 cameras lets remote attackers execute OS commands through the ping utility's host/interface argument.
- Security
CVE-2026-86152: Max-Severity Tenda CP3 Command Injection via AutoAddWifi
CVSS 10.0 flaw in Tenda CP3's Kylin AutoAddWifi thread lets remote attackers inject and execute arbitrary OS commands.
- Security
CVE-2026-86151: Tenda CP3 OS Command Injection via Network Config Handler
Tenda CP3 firmware 27.5.57.101 lets remote attackers inject OS commands through its network configuration handler, no authentication noted.
- Security
CVE-2026-86153: Tenda CP3 Improper Privilege Management in Redirect Service
Tenda CP3's SetRedirectEnable function lacks authorization checks, letting remote attackers alter port-forwarding without admin access.
- Security
Tenda HG10 Routers Hit By Critical Unauthenticated Buffer Overflow
A critical buffer overflow in Tenda HG10 firmware's formURL function allows remote memory corruption with a public exploit and no patch yet.
- Security
Tenda HG10 formgponConf Flaw Allows Unauthenticated Root Command Injection
A near-maximum-severity OS command injection in Tenda HG10's formgponConf function lets attackers run root commands remotely; no patch is available.
- Security
CVE-2026-85222: D-Link DNS-340L Command Injection Has No Fix Coming
An unauthenticated OS command injection in the DNS-340L's Add-On Center CGI grants root — and D-Link has declared the device end-of-life.
- Security
CVE-2026-38577: Tenda HG21 Hardcoded Admin Credentials
Hardcoded admin credentials baked into Tenda HG21 firmware let attackers bypass authentication and gain full root access to the router.
- Security
Shinobi NVR: Hardcoded Child-Node Key Enables Unauthenticated Database Compromise (CVE-2026-82448)
CVE-2026-82448 (CVSS 9.8): a hardcoded key in Shinobi's child-node service lets attackers run arbitrary SQL against user and camera data.
- Security
rust-iot-platform: Missing Auth Guards Expose the Entire User-Management API (CVE-2026-82452)
CVE-2026-82452 (CVSS 9.8): rust-iot-platform's REST API lacks auth checks — anyone can create, edit, or delete accounts, no login required.
- News
Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE — One Starts Over Bluetooth
Researcher discloses two root RCE chains in the Unitree G1 EDU robot; one is a wormable, unauthenticated Bluetooth exploit reaching root remotely.
- Security
CVE-2026-77533: UniFi Protect Command Injection via Improper Input Validation
A critical flaw in UniFi Protect lets a low-privileged, network-adjacent attacker inject OS commands on the host device. Patch to 7.2.105+.
- Security
CVE-2026-66747: Zbtlink Routers Ship ENDLESSDOORS Firmware Backdoor (CVSS 9.8)
Every published Zbtlink router firmware build contains ENDLESSDOORS — an embedded root-level remote control implant disguised as a Linux kernel worker...
- Security
CVE-2026-61514: Puwell IP Camera Authentication Bypass
A critical authentication bypass in Puwell IP Camera firmware 2.x through 4.x allows unauthenticated attackers to access live video streams, control...
- Security
CVE-2026-61515: Puwell IP Camera Unauthenticated Command Injection
A critical unauthenticated command injection vulnerability in Puwell IP Camera firmware 2.x through 4.x allows remote attackers to execute arbitrary OS...
- News
LG to Ban Residential Proxies from Smart TV Apps
LG Electronics USA announced it will suspend Smart TV apps that enroll viewers' televisions into residential proxy networks — a move triggered by research...
- Security
CVE-2026-24013: Apache IoTDB Authentication Bypass via Forged Session ID
A critical authentication bypass in Apache IoTDB allows unauthenticated attackers to forge Thrift RPC session IDs and receive valid time-series query...
- Security
CVE-2026-24014: Apache IoTDB DataNode Path Traversal via Trigger JAR Upload
A critical path traversal vulnerability in Apache IoTDB's DataNode RPC interface allows unauthenticated attackers to write arbitrary files outside the...
- Security
GeoVision LPC Camera Critical RCE via thttpd Buffer Overflow (CVE-2026-57878)
A critical unauthenticated stack-based buffer overflow in thttpd on GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote attackers to execute...
- Security
GeoVision LPC Camera Critical RCE via ssvr RTSP Auth Buffer Overflow (CVE-2026-57879)
A critical unauthenticated stack-based buffer overflow in the ssvr RTSP service of GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote attackers to...
- Security
GeoVision LPC Camera Critical RCE via ssvr RTSP Digest Auth Buffer Overflow (CVE-2026-57880)
A critical unauthenticated stack-based buffer overflow in GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote code execution by exploiting...
- Security
GeoVision LPC Camera Critical RCE via vlsvr Remote Login Buffer Overflow (CVE-2026-57881)
A critical unauthenticated stack-based buffer overflow in the vlsvr daemon of GeoVision GV-LPC2011 and GV-LPC2211 cameras allows remote code execution...
- News
Alleged Kimwolf Botmaster ''Dort'' Arrested, Charged in U.S. and Canada
Canadian authorities arrested a 23-year-old Ottawa man suspected of building and operating Kimwolf, an IoT botnet that enslaved millions of devices for...
- News
US and Canada Arrest and Charge Suspected Kimwolf Botnet
U.S. and Canadian authorities arrested and charged a Canadian man with operating the Kimwolf DDoS botnet, which infected nearly two million devices...
- News
EnOcean SmartServer Flaws Expose Buildings to Remote Hacking
Claroty researchers have disclosed two vulnerabilities in the EnOcean SmartServer IQ building management controller that can be chained for security...
- Security
CVE-2026-7136: Totolink A8000RU OS Command Injection via setDmzCfg
A critical OS command injection vulnerability in the Totolink A8000RU router allows remote attackers to execute arbitrary commands by manipulating the...
- News
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack
Threat actors are deploying the Nexcorium Mirai botnet variant by exploiting CVE-2024-3721 in TBK DVR devices and targeting end-of-life TP-Link Wi-Fi...
- News
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache
This week's ThreatsDay Bulletin from The Hacker News covers 20 active threats including a hybrid P2P DDoS botnet, a 13-year-old Apache ActiveMQ RCE flaw...
- Security
CVE-2026-28766: Gardyn Smart Garden API Exposes All User
A critical unauthenticated information disclosure vulnerability in the Gardyn smart garden platform exposes all registered user account information via a...
- Security
Critical Grandstream VoIP Vulnerability Allows
A critical CVSS 9.3 stack-based buffer overflow in Grandstream GXP1600 series VoIP phones allows unauthenticated remote code execution, enabling attackers...