The research was conducted on the TOTOLINK A720R router, on its latest available firmware. During said research, I identified three separate vulnerabilities affecting the same component handling the backend of the web management interface: Telnet backdoor: a hidden, unauthenticated Telnet service protected by a hardcoded secret. Argument Injection (CVE-2025-63821): insufficient input validation allowing user-controlled arguments […]
Introduction Not all stories end with the expected and hoped-for results, and this story is one of them. We’re releasing a three-part series detailing our unsuccessful Pwn2Own 2024 attempt targeting two IP cameras. The contest forces you into a completely different mindset compared to standard security assessment activities. Here, you have only one objective: compromise […]
There is a lot of hype around DNS rebinding vulnerability and vulnerable IoT devices, including home cameras, air conditioners or climate control devices; this flaw will cover the lack of origin checking on HTTP requests. DNS Rebinding Attack DNS Rebinding allows an attacker who has control on a DNS server to communicate with a device […]