Researchers Show Hidden Commands in Images Exploit AI Chatbots and Steal Data
Source: https://hackread.com/hidden-commands-images-exploit-ai-chatbots-steal-data/
**TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched.4,247 vulnerable devices found online.**
# The Discovery
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function `sub_1e294` that processes SOAP SetParameterValues messages.
**Key Technical Details:**
* Stack buffer: 3072 bytes
* PC register overwrite: 3112 bytes (payload: "A"\*3108 + "BBBB")
* Result: `pc = 0x42424242` (full control)
* Canary exploit mitigations
# Proof of Concept
// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size);
// OVERFLOW!
Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
# Impact
**Affected Models:**
* TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
* TP-Link Archer AX1500 (identical binary)
* Potentially: EX141, Archer VR400, TD-W9970
**Firmware Versions:** 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
**Internet Exposure:** 4,247 unique IPs confirmed vulnerable via Fofa search
# Why This Matters
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
# Timeline
* **Discovery:** January 2025 (automated analysis)
* **Vendor Notification:** May 11th, 2024
* **Current Status:** Probably Patched
* **Public Disclosure:** Now
WhatsApp 0-Day Exploited in Attacks on Targeted iOS and macOS Users
Source: https://hackread.com/whatsapp-0-day-exploit-attack-targeted-ios-macos-users/
New zero-click exploit allegedly used to hack WhatsApp users
Source: https://securityaffairs.com/181714/intelligence/new-zero-click-exploit-allegedly-used-to-hack-whatsapp-users.html
We recently published a breakdown of a subtle but impactful vulnerability: misconfigured upload paths that allow public access to uploaded files.
The core issue occurs when a webserver accepts file uploads but stores them in a directory directly accessible via the browser. If there’s no validation or access control, attackers can upload malicious files—like webshells or phishing pages—and access them immediately.
How do others approach detecting and preventing this kind of misconfiguration? Have you seen this exploited in the wild? What tooling or scanning techniques do you use to catch it?
CISA Adds Citrix and Git Flaws to KEV Catalogue Amid Active Exploitation
Source: https://hackread.com/cisa-citrix-git-flaw-kev-catalog-amid-active-exploitation/
Over 28,000 Citrix devices vulnerable to new exploited RCE flaw
Source: https://www.bleepingcomputer.com/news/security/over-28-200-citrix-instances-vulnerable-to-actively-exploited-rce-bug/
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Source: https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html
CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git
Source: https://thehackernews.com/2025/08/cisa-adds-three-exploited.html
