hardware — PoC Archivehttps://poc.intelseclab.com/pocs/hardware/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856)https://poc.intelseclab.com/pocs/hardware/2026-07-06_cve-2025-65856-onvif-camera-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-06_cve-2025-65856-onvif-camera-auth-bypass/Critical severity (CVSS 9.8) — hardware · CVE-2025-65856. Status: Weaponized. Affects: Xiongmai XM530-based IP camera ONVIF service (tested on model XM530_50X50-WG_8M). Tags: xiongmai, xm530, onvif, ip-camera, iot, auth-bypass, access-control, information-disclosure, rtsp, cwe-306, cwe-287, python, bash, curl.hardwareCriticalxiongmaixm530onvifip-cameraiotauth-bypassaccess-controlinformation-disclosurertspcwe-306cwe-287pythonbashcurlZXIC/Sanechips ZX297520V3 BootROM Arbitrary Memory Write via USB Download Mode (CVE-2026-40003)https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-40003-zx297520v3-bootrom-memory-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-40003-zx297520v3-bootrom-memory-write/High severity — hardware · CVE-2026-40003. Status: Weaponized. Affects: ZXIC/Sanechips ZX297520V3 SoC BootROM (used in USB modem/baseband devices). Tags: bootrom, usb-download-mode, socket-modem, zx297520v3, arbitrary-memory-write, embedded, baseband, reverse-engineering.hardwareHighbootromusb-download-modesocket-modemzx297520v3arbitrary-memory-writeembeddedbasebandreverse-engineeringPX4-Autopilot tattu_can Driver — CAN Bus Stack Buffer Overflow DoS (CVE-2026-32707)https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32707-px4-tattu-can-buffer-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32707-px4-tattu-can-buffer-overflow/High severity (CVSS 7.5) — hardware · CVE-2026-32707 (GHSA-wxwm-xmx9-hr32, CWE-121). Status: PoC. Affects: PX4-Autopilot flight controller firmware, tattu_can driver. Tags: px4, autopilot, can-bus, socketcan, stack-buffer-overflow, drone, uav, denial-of-service.hardwareHighpx4autopilotcan-bussocketcanstack-buffer-overflowdroneuavdenial-of-servicePX4 Autopilot MAVLink FTP Stack Buffer Overflow (CVE-2026-32743)https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32743-px4-mavlink-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32743-px4-mavlink-overflow/Medium severity (CVSS 6.5) — hardware · CVE-2026-32743. Status: PoC. Affects: PX4 Autopilot flight controller firmware. Tags: px4, autopilot, mavlink, drone, uav, buffer-overflow, denial-of-service, mavlink-ftp.hardwareMediumpx4autopilotmavlinkdroneuavbuffer-overflowdenial-of-servicemavlink-ftpOpenPLC_v3 glue_generator Path Traversal — CVE-2026-31156https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-31156-openplc-glue-generator-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-31156-openplc-glue-generator-traversal/High severity — hardware · CVE-2026-31156. Status: PoC. Affects: OpenPLC_v3 — utils/glue_generator_src/glue_generator.cpp build/code-generation utility. Tags: openplc, ics, path-traversal, arbitrary-file-write, glue-generator, cpp, plc, industrial-control.hardwareHighopenplcicspath-traversalarbitrary-file-writeglue-generatorcppplcindustrial-controlMarlin Firmware M421 G-code Handler Out-of-Bounds Write — CVE-2026-56111https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-56111-marlin-m421-oob-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-56111-marlin-m421-oob-write/High severity (CVSS 8.3) — hardware · CVE-2026-56111. Status: PoC. Affects: Marlin Firmware (3D printer firmware), builds compiled with MESH_BED_LEVELING. Tags: marlin, 3d-printer, firmware, g-code, out-of-bounds-write, mesh-bed-leveling, denial-of-service, embedded.hardwareHighmarlin3d-printerfirmwareg-codeout-of-bounds-writemesh-bed-levelingdenial-of-serviceembedded