Embedded — PoC Archivehttps://poc.intelseclab.com/tags/embedded/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Tenda AC9 `AdvSetMacMtuWan` Stack-Based Buffer Overflow (CVE-2025-29384)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Critical severity (CVSS 9.8) — network · CVE-2025-29384. Status: PoC. Affects: Tenda AC9 dual-band wireless router, web management interface (/goform/AdvSetMacMtuWan endpoint). Tags: tenda, ac9, router, stack-buffer-overflow, cwe-121, dos, rce, mips, embedded, iot, python, ruby, metasploit.networkCriticaltendaac9routerstack-buffer-overflowcwe-121dosrcemipsembeddediotpythonrubymetasploitZXIC/Sanechips ZX297520V3 BootROM Arbitrary Memory Write via USB Download Mode (CVE-2026-40003)https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-40003-zx297520v3-bootrom-memory-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-40003-zx297520v3-bootrom-memory-write/High severity — hardware · CVE-2026-40003. Status: Weaponized. Affects: ZXIC/Sanechips ZX297520V3 SoC BootROM (used in USB modem/baseband devices). Tags: bootrom, usb-download-mode, socket-modem, zx297520v3, arbitrary-memory-write, embedded, baseband, reverse-engineering.hardwareHighbootromusb-download-modesocket-modemzx297520v3arbitrary-memory-writeembeddedbasebandreverse-engineeringTenda HG7/HG9/HG10 Router Stack-Based Buffer Overflow — CVE-2026-11499https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/High severity — network · CVE-2026-11499. Status: PoC. Affects: Tenda HG7 / HG9 / HG10 routers (firmware family HG7_HG9_HG10re_300001138_en_xpon and similar). Tags: tenda, router, buffer-overflow, cwe-121, dos, embedded, iot, rce.networkHightendarouterbuffer-overflowcwe-121dosembeddediotrceMarlin Firmware M421 G-code Handler Out-of-Bounds Write — CVE-2026-56111https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-56111-marlin-m421-oob-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-56111-marlin-m421-oob-write/High severity (CVSS 8.3) — hardware · CVE-2026-56111. Status: PoC. Affects: Marlin Firmware (3D printer firmware), builds compiled with MESH_BED_LEVELING. Tags: marlin, 3d-printer, firmware, g-code, out-of-bounds-write, mesh-bed-leveling, denial-of-service, embedded.hardwareHighmarlin3d-printerfirmwareg-codeout-of-bounds-writemesh-bed-levelingdenial-of-serviceembeddedlwIP SNMPv3 USM Stack-Based Buffer Overflow (CVE-2026-8836)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8836-lwip-snmpv3-stack-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8836-lwip-snmpv3-stack-overflow/Critical severity (CVSS 9.8) — network · CVE-2026-8836. Status: PoC. Affects: lwIP (lightweight TCP/IP stack) — snmp_parse_inbound_frame() in src/apps/snmp/snmp_msg.c. Tags: lwip, snmp, snmpv3, stack-overflow, embedded, rce, asn1, cwe-121.networkCriticallwipsnmpsnmpv3stack-overflowembeddedrceasn1cwe-121GeoVision GV-I/O Box 4E DVRSearch Unauthenticated Stack Buffer Overflow RCE (CVE-2026-12485)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-12485-geovision-dvrsearch-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-12485-geovision-dvrsearch-rce/Critical severity (CVSS 10) — network · CVE-2026-12485. Status: PoC. Affects: GeoVision GV-I/O Box 4E (Linux-based smart embedded I/O device). Tags: RCE, unauthenticated, stack-overflow, buffer-overflow, IoT, GeoVision, DVR, embedded, UDP, network, Python, CVSS-10.networkCriticalRCEunauthenticatedstack-overflowbuffer-overflowIoTGeoVisionDVRembeddedUDPnetworkPythonCVSS-10