Reverse Engineering the Little Tikes Dream Machine Projector – Part 1

Part 1 of my journey into reverse engineering the little tikes dream machine projector.

Reverse engineering the MISIRUN Instant Print Kids Camera

My tubs of hardware to hack continues to grow and the rediscovery of Woot! (miss the OG Woot!). Although it's in the future, I decided to pick up a few of these cameras as they were on a steep sale. I figured that they weren't going to be groundbreaking but fun to hack, especially as … Continue reading Reverse engineering the MISIRUN Instant Print Kids Camera →

CVE-2025-25727,CVE-2025-25728,CVE-2025-25729 Multiple Vulnerabilities found in BossComm OBD2 Tablet

Continuing my growth in the realm of hardware hacking, IoT and embedded penetration testing, I have purchased too many devices to perform some (mostly light) reverse engineering. Before going further, here are the required details for CVE references: CVE-2025-25727 Affected Product and Version: IF740 - Firmware Versions: 11001.7078 & 11001.0000 (Confirmed) & System Versions: 6.25 … Continue reading CVE-2025-25727,CVE-2025-25728,CVE-2025-25729 Multiple Vulnerabilities found in BossComm OBD2 Tablet →

CVE-2025-25730 Developer Options and USB Debugging Authorization Bypass in Motorola Droid Razr HD (XT926)

Read about why and how I found CVE-2025-25730 - Developer Options and USB Debugging Authorization Bypass in Motorola Droid Razr HD (XT926)

CVE-2024-32210, CVE-2024-32211, CVE-2024-32212, CVE-2024-32213 LoMag (Integrator/CE) WareHouse Management

The post discusses the discovery of multiple CVEs in LoMag WareHouse Management, including hard-coded credentials, weak hash usage, and SQL injection vulnerabilities. The author provides insights into their discovery process and highlights the insecure coding practices in the application.

CVE-2022-34108, CVE-2022-34109, CVE-2022-34110 DoS + Arbitrary file Download/Copy in MSI Feature Navigator

Denial Of Service and an Arbitrary file copy and download found in MSI's Feature Navigator demo software!

CVE-2022-34615, CVE-2022-34621, CVE-2022-34623, CVE-2022-34624 – IDOR, User Enum and More (In Mealie)

Multiple new CVEs discovered and disclosed! IDOR, User Enum, invalid session termination and a weak password policy!

CVE-2022-37857, CVE-2022-37163, CVE-2022-37164 Hardcoded Credentials/Weak Password Policies

A location sharing open source server and android client was found to hardcode credentials and allow weak passwords by default (including blank passwords!)

CVE-2022-35142, CVE-2022-35143, CVE-2022-35144 – DoS, XSS and Weak Password Policy in Renato a Markdown powered knowledge base

Multiple new CVEs discovered and disclosed! XSS, DoS and a weak password policy!

CVE-2022-34613, CVE-2022-34618, CVE-2022-34619 – Multiple XSS (And more) in Mealie

Multiple new CVEs discovered and disclosed! XSS, file uploads and more!