rce

In 2021 I discovered several high and critical vulnerabilities in the Kaseya Unitrends backup appliance. This research was conducted and published as part of my day job. Part one details a chain of vulnerabilities by leveraging an insecure PostgreSQL database to ultimately gain shell access to the remote server. Visit https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 for the full write-up. Stay tuned for part two.

I discovered several vulnerabilities in the MoFi4500 LTE router. Several vulnerabilities have not been patched, including an unauthenticated remote command injection and several undocumented backdoors. The full write-up can be viewed at https://cyberonesecurity.com/offensive-security/critical-vulnerabilities-discovered-in-mofi-routers/. Media Coverage https://www.cyberscoop.com/mofi-networks-routers-zero-day-critical-start/ https://www.zdnet.com/article/backdoors-left-unpatched-in-mofi-routers/ Follow the conversation on Twitter https://twitter.com/TeamAresSec/status/1301200248417775618?s=20