漏洞

漏洞

78 篇文章

笔记

笔记

1 篇文章

其他

其他

3 篇文章

FirmAudit2 进阶篇：3天5本CNVD，从固件到操作系统——新增 OS 镜像 / 内核审计能力
2026-11-06 2026-11-06 3.2k 字 12 分钟

FirmAudit2 进阶篇：3天5本CNVD，从固件到操作系统——新增 OS 镜像 / 内核审计能力

一、先交代问题设定首篇推文（《FirmAudit2：从解包到 CNVD 交付，固件漏洞审计流水线》）讲的是固件审计那条线：上传一份路由器固件，平台替你走完解包、静态、仿真、验证，最后打包出一份能直接交 CNVD 的资料。 但有我在宿舍突发奇想，考虑另一个场景：如果手里不是一份固件，而是一整张系统盘/系统镜像——一个 .iso、一个 qcow2 虚拟机镜像、或者一组 bzImage + rootfs呢？ 这种目标，光”解包看文件系统”远远不够，真正要审的是内核、基础网络栈、驱动和认证权限组件：syscall 接口的越界写入、ioctl 的 copy_from_user 边界、提权路径里
Tenda CP6 V11.10.00.243: /etc/passwd Hardcoded Root Weak Password (Unauthenticated, Root Access)
2026-11-05 2026-11-06 9 字 1 分钟

Tenda CP6 V11.10.00.243: /etc/passwd Hardcoded Root Weak Password (Unauthenticated, Root Access)

This content is encrypted, please enter the password to view.
Tenda CP6 V11.10.00.243: wagent CGI Quote-Wrapping Command Injection (Unauthenticated, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

Tenda CP6 V11.10.00.243: wagent CGI Quote-Wrapping Command Injection (Unauthenticated, Root RCE)

This content is encrypted, please enter the password to view.
Xiaomi MiWiFi R4C 2.30.19: macfilterctl setRule mac Field iptables Command Injection (MAC Whitelist Bypass Prerequisite, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

Xiaomi MiWiFi R4C 2.30.19: macfilterctl setRule mac Field iptables Command Injection (MAC Whitelist Bypass Prerequisite, Root RCE)

This content is encrypted, please enter the password to view.
Tenda CP6 V11.10.00.243: getsnapshot.cgi QUERY_STRING Command Injection (Unauthenticated, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

Tenda CP6 V11.10.00.243: getsnapshot.cgi QUERY_STRING Command Injection (Unauthenticated, Root RCE)

This content is encrypted, please enter the password to view.
Xiaomi MiWiFi R4C 2.30.19: macfilterctl MAC Filter Rule Lua Code Injection (Authenticated, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

Xiaomi MiWiFi R4C 2.30.19: macfilterctl MAC Filter Rule Lua Code Injection (Authenticated, Root RCE)

This content is encrypted, please enter the password to view.
Alpine Linux minirootfs 3.24.0 x86: apk-tools 3.0.6 Directory Symlink Traversal Arbitrary File Overwrite (No Auth Required, Root Privilege Escalation and Persistence)
2026-11-05 2026-11-06 9 字 1 分钟

Alpine Linux minirootfs 3.24.0 x86: apk-tools 3.0.6 Directory Symlink Traversal Arbitrary File Overwrite (No Auth Required, Root Privilege Escalation and Persistence)

This content is encrypted, please enter the password to view.
TP-LINK TL-FW5600E 1.11.2: usermngr.lua add_user username Parameter Command Injection (Authenticated, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

TP-LINK TL-FW5600E 1.11.2: usermngr.lua add_user username Parameter Command Injection (Authenticated, Root RCE)

This content is encrypted, please enter the password to view.
Tenda TC3T14C V25.4.26.15: Kylin CNetApp::OnConfigNetwork Command Injection (Network Configuration Input, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

Tenda TC3T14C V25.4.26.15: Kylin CNetApp::OnConfigNetwork Command Injection (Network Configuration Input, Root RCE)

This content is encrypted, please enter the password to view.
Tenda TES7002 V4.0.0: boa formImportOMCIShell Uploaded Script Execution (Unauthenticated Reachability Likely, Root RCE)
2026-11-05 2026-11-06 9 字 1 分钟

Tenda TES7002 V4.0.0: boa formImportOMCIShell Uploaded Script Execution (Unauthenticated Reachability Likely, Root RCE)

This content is encrypted, please enter the password to view.