IoT security Archives • Page 3 of 4 • Daily CyberSecurity

Broadcast Hijack: Critical KiloView Flaw (CVSS 9.8) Grants Full Control

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

Broadcast Hijack: Critical KiloView Flaw (CVSS 9.8) Grants Full Control

Do Son February 3, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding a maximum-severity vulnerability in...

Router Takeover: High-Severity Command Injection Flaw Hits TP-Link Archer MR600

Do Son January 28, 2026

TP-Link has issued a security advisory for its popular Archer MR600 4G+ LTE router, warning of a...

Critical Vivotek Flaw Grants Root Access (CVE-2026-22755) Gardyn Home Kit Vulnerabilities IoT Command Injection Vivotek Vulnerability CVE-2026-22755 Command Injection Ofuji Fishing data breach

Gardyn Home Kit Vulnerabilities IoT Command Injection Vivotek Vulnerability CVE-2026-22755 Command Injection Ofuji Fishing data breach

Critical Vivotek Flaw Grants Root Access (CVE-2026-22755)

Do Son January 22, 2026

A new critical vulnerability has been unearthed in the firmware of Vivotek legacy cameras, potentially turning thousands...

CVE-2026-0629: TP-Link VIGI Flaw Lets Attackers Reset Admin Passwords

Do Son January 21, 2026

A critical security vulnerability has been discovered in TP-Link’s VIGI series surveillance cameras, allowing attackers on a...

WhisperPair: Critical Fast Pair Flaw Exposes Headphones to Hijacking WhisperPair Vulnerability Google Fast Pair Flaw

WhisperPair: Critical Fast Pair Flaw Exposes Headphones to Hijacking

Do Son January 20, 2026

Your high-end Bluetooth headphones might be listening to more than just your music. A new report from...

Canon Critical Alert: 7 New Flaws Expose Printers to Remote Hackers CVE-2024-47406 CVE-2025-1268 Canon Printer Vulnerability CVE-2025-14231

Canon Critical Alert: 7 New Flaws Expose Printers to Remote Hackers

Do Son January 16, 2026

Canon has issued a security advisory for its small office and laser printer lineups, warning of seven...

Double Critical: Hardcoded Secrets Expose Ruckus IoT Controllers to Root RCE Ruckus vRIoT Vulnerability CVE-2025-69425 Ruckus Wireless, Critical Vulnerabilities

Ruckus vRIoT Vulnerability CVE-2025-69425 Ruckus Wireless, Critical Vulnerabilities

Double Critical: Hardcoded Secrets Expose Ruckus IoT Controllers to Root RCE

Do Son January 13, 2026

A pair of critical security vulnerabilities has been disclosed in the Ruckus vRIoT IoT Controller, the central...

Bluetooth Broken? Apache NimBLE Flaws Enable Spoofing & Eavesdropping Apache NimBLE Vulnerabilities Bluetooth Spoofing

Bluetooth Broken? Apache NimBLE Flaws Enable Spoofing & Eavesdropping

Do Son January 9, 2026

The Apache Software Foundation has issued urgent patches for Apache NimBLE, the open-source Bluetooth 5.4 stack used...

CVE-2025-65606: TOTOLINK EX200 Error Opens Root Telnet Door TOTOLINK EX200 Vulnerability CVE-2025-65606 TOTOLINK Auth Bypass, Unauthenticated Telnet

TOTOLINK EX200 Vulnerability CVE-2025-65606 TOTOLINK Auth Bypass, Unauthenticated Telnet

CVE-2025-65606: TOTOLINK EX200 Error Opens Root Telnet Door

Do Son January 7, 2026

A peculiar and dangerous vulnerability has been uncovered in the TOTOLINK EX200 Wi-Fi extender, one that turns...

Check Point VPN vulnerability exploited in the wild Check Point VPN exploit CVE-2026-50751 zero-day Checkmarx Breach Supply Chain Attack Ivanti EPMM RCE CVE-2026-1281 Modular DS Vulnerability CVE-2026-23550 D-Link RCE Vulnerability CVE-2026-0625 Christmas 2025 GreyNoise Campaign, Japan-Based Initial Access Broker React2Shell Zero-Day, APT Active Exploitation WordPress vulnerability, authentication bypass FreePBX, zero-day Trend Micro Apex One, Remote Code Execution BitoPro Hack, Crypto Theft UNC5337 - CVE-2022-47945 Safe{Wallet} hack Fortinet vulnerability, CVE-2024-21762, FortiGate attack Balloonfly, Play ransomware Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

CVE-2026-0625: Critical Actively Exploited RCE Hits Unpatchable D-Link Routers

Do Son January 7, 2026

Security researchers warn that a critical remote code execution (RCE) vulnerability in legacy D-Link DSL routers is...

MediaTek Kicks Off 2026 with Major Security Overhaul for Mobile Chipsets MediaTek Modem Vulnerabilities, January 2026 Security Bulletin MediaTek Vulnerabilities, Chipset Security CVE-2024-20103 & CVE-2024-20100 - CVE-2024-20154 - February 2025 Product Security Bulletin

MediaTek Kicks Off 2026 with Major Security Overhaul for Mobile Chipsets

Do Son January 6, 2026

MediaTek has kicked off the new year with a critical security bulletin, releasing patches for a slew...

Apache NuttX RTOS Patches Two Filesystem Flaws Apache NuttX, CVE-2025-48769

Apache NuttX RTOS Patches Two Filesystem Flaws

Do Son January 1, 2026

The Apache Software Foundation has released updates for Apache NuttX, a real-time operating system (RTOS) widely used...

“RondoDoX” Strikes Back: Exposed Logs Reveal Massive 9-Month Campaign Targeting Next.js and IoT AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

“RondoDoX” Strikes Back: Exposed Logs Reveal Massive 9-Month Campaign Targeting Next.js and IoT

Do Son December 31, 2025

The RondoDoX botnet has resurfaced with a potent new arsenal, shifting its sights from simple routers to...

Zero-Day Alert: Linksys Auth Bypass Lets Hackers Hijack Routers Without Passwords Linksys Auth Bypass, CVE-2025-52692

Zero-Day Alert: Linksys Auth Bypass Lets Hackers Hijack Routers Without Passwords

Do Son December 23, 2025

A popular Wi-Fi 6 router found in thousands of homes has been blown wide open by security...

The Wolf Among TVs: 1.8 Million-Strong Kimwolf Botnet Surpasses Google Traffic to Rule the IoT Kimwolf botnet Android TV, ENS EtherHiding C2

The Wolf Among TVs: 1.8 Million-Strong Kimwolf Botnet Surpasses Google Traffic to Rule the IoT

Do Son December 20, 2025

Chinese cybersecurity firm QiAnXin has released a report detailing a newly identified distributed denial-of-service botnet dubbed Kimwolf,...

Zero-Day Warning: Unpatched Twonky Server Flaws Expose Media to Total Takeover WHILL Wheelchair Hijacking, CVE-2025-14346 MAS typosquatting malware, get.activate.win vs get.activated.win OpenShift GitOps RCE, Cluster Takeover Flaw Twonky Server, CVE-2025-13315 AI agents CVE-2024-52875 PoC

WHILL Wheelchair Hijacking, CVE-2025-14346 MAS typosquatting malware, get.activate.win vs get.activated.win OpenShift GitOps RCE, Cluster Takeover Flaw Twonky Server, CVE-2025-13315 AI agents CVE-2024-52875 PoC

Zero-Day Warning: Unpatched Twonky Server Flaws Expose Media to Total Takeover

Do Son November 27, 2025

A critical security warning has been issued for users of Twonky Server, the popular media server software...

Critical Unpatched Flaw: Vivotek EOL IP Cameras Exposed to Unauthenticated RCE via Command Injection

Do Son November 25, 2025

The Akamai Security Intelligence and Response Team (SIRT) has uncovered a previously undocumented — and still widely...

RondoDox Botnet Unleashed: New Malware Uses ‘Exploit Shotgun’ to Target 50+ Router and IoT Flaws AdaptixC2 Abuse, Russian Cybercrime RondoDox Botnet, Exploit Shotgun China Cyber Power, Red Hackers Nvidia cyberattack

AdaptixC2 Abuse, Russian Cybercrime RondoDox Botnet, Exploit Shotgun China Cyber Power, Red Hackers Nvidia cyberattack

RondoDox Botnet Unleashed: New Malware Uses ‘Exploit Shotgun’ to Target 50+ Router and IoT Flaws

Do Son October 10, 2025

Trend Micro has uncovered a rapidly expanding botnet campaign dubbed RondoDox, which is targeting a wide spectrum...

PoC Published: Critical Unauthenticated Command Injection Flaw in D-Link Routers (CVSS 9.8), No Patch! D-Link, command injection

PoC Published: Critical Unauthenticated Command Injection Flaw in D-Link Routers (CVSS 9.8), No Patch!

Do Son August 29, 2025

D-Link has issued a Security Announcement regarding multiple critical vulnerabilities discovered in its legacy DIR-series routers. These...

PoC Available: D-Link Router Flaw with CVSS 9.8 and No Patch D-Link EOL RCE, Unauthenticated Command Injection D-Link Command Injection CVE-2025-57105