🔎 HIGH-severity (CVSS 8.7) buffer overflow in Shenzhen Libituo LBT-T300-HW1 (v1.2.0 – 1.2.8), CVE-2026-7674. Web Management Interface at risk, remote exploit possible. No patch yet — restrict access & stay alert. https://radar.offseq.com/threat/cve-2026-7674-buffer-overflow-in-shenzhen-libituo--817395ad #OffSeq #Vuln #IoTSec #Infosec
🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec
🔒 CVE-2026-5851: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote, unauthenticated RCE possible via /cgi-bin/cstecgi.cgi. Exploit public, no patch. Isolate device and check for updates! https://radar.offseq.com/threat/cve-2026-5851-os-command-injection-in-totolink-a71-cec71662 #OffSeq #CVE20265851 #IoTSec
Masjesu Botnet neu unterwegs: DDoS-for-Hire via Telegram, infiziert IoT (Router/Gateways, multi-arch). Hohe Persistence, vermeidet Blacklists/CI. Default-Passwörter killen! THN: https://thehackernews.com/2026/04/masjesu-botnet-emerges-as-ddos-for-hire.html #IoTSec #DDoS
Masjesu Botnet Emerges as DDoS-for-Hire Service Targeting Global IoT Devices

Masjesu botnet drives global DDoS attacks since 2023, with nearly 50% traffic from Vietnam, threatening enterprises and IoT devices.

The Hacker News
🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec
⚠️ CVE-2025-41108 (CRITICAL): Ghost Robotics Vision 60 v0.27.2 lets attackers hijack robots by spoofing control commands over MAVLink (no auth/encryption). Segment networks & monitor traffic while awaiting patch. https://radar.offseq.com/threat/cve-2025-41108-cwe-287-improper-authentication-in--fef464fa #OffSeq #CVE202541108 #Robotics #IoTSec
In the #iotsec front, here's a new package to play with, involving #mud (manufacturer usage descriptions) and RFC 8520. mudcerts (https://github.com/iot-onboarding/mudcerts) is a Go package that can generate a demo CA, signer cert, and #IEEE 802.1AR cert, as well as verify it.
GitHub - iot-onboarding/mudcerts: Go routines that can be used to generate and verify MUD certificates

Go routines that can be used to generate and verify MUD certificates - iot-onboarding/mudcerts

GitHub

👋#call4reading

✍️Modeling #IoT based Forest #FireDetection System with #IoTsec #by Meziane Hind, Ouerdi Noura and Ajith Abraham

🔗https://cspub-ijcisim.org/index.php/ijcisim/article/view/535

Modeling IoT based Forest Fire Detection System with IoTsec | International Journal of Computer Information Systems and Industrial Management Applications

Hypponen's Law ( @mikko ) confirmed (again):

"At the Usenix Workshop on Offensive Technologies earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear."

Citation:
https://www.wired.com/story/shimano-wireless-bicycle-shifter-jamming-replay-attacks/z

#iot #infosec #cybersecurity #IoTSec

Dutch ethical hacker Wietse Boonstra discovered a critical vulnerability in solar panel systems that could have allowed disruption of 4 million systems across 150 countries. The vulnerability affected systems made by Enphase, an American company. Boonstra found a flaw that allowed him to become an administrator of multiple accounts without permission.

Sources:

1. Dutch Institute for Vulnerability Disclosure (DIVD) report: https://www.divd.nl/newsroom/articles/divd-responsibly-discloses-six-new-zero-day-vulnerabilities-to-vendor/

2. Original reporting from Follow the Money (FTM), a Dutch investigative outlet: https://archive.is/BVR80

3. Euractiv summary article (English): https://www.euractiv.com/section/energy-environment/news/hacker-shines-spotlight-on-vulnerability-of-solar-panels-installed-in-europe/

#infosec #cybersecurity #renewableenergy #ethicalhacking #iotsec

DIVD responsibly discloses six new zero-day vulnerabilities to vendor