-
CVE-2025-47372: Buffer Copy Without Checking Size of Input in Boot (5th Dec-2025)
Qualcomm – Official announcement: 1st Dec 2025 Quote: I chose a Qualcomm product affected by this vulnerability as an example. The Snapdragon Ride™ Flex SoC, including the SA9000P series, does not run on a single embedded OS, but rather supports mixed-criticality operating systems such as those provided by Qualcomm’s partners or the automaker themselves. Preface:…
-
CVE-2025-66216: About AIS-catcher (3rd Dec 2025)
Preface: AIS-Catcher is a MIT licensed dual band AIS receiver for Linux, Windows and Raspberry Pi. It is compatible with RTL-SDR dongles and the Airspy HF+. AIS stands for Automatic Identification System and is used by marine vessels to broadcast their GPS locations in order to help avoid collisions and aide with rescues. An RTL-SDR…
-
CVE-2025-48507: About calling processor into Arm Trusted Firmware (26th Nov 2025)
Preface: AMD’s Zynq™ UltraScale+™ RFSoCs are a family of highly integrated adaptive Systems-on-Chip (SoCs) that combine a multi-core Arm® processing system, programmable logic (FPGA fabric), and direct RF-sampling data converters (ADCs and DACs) on a single chip. CVE-2025-48507 Affected Devices: Kria™ SOM, Zynq™ UltraScale+™ MPSoCs and Zynq™ UltraScale+™ RFSoCs. Background: The crypto operations in Arm®…
-
In-depth analysis of the Android 0-Click vulnerability – CVE-2025-48593. The issue has been resolved. (20th Nov 2025)
Published: 2025-11-17 Preface: An HFP (Hands-Free Profile) device is a Bluetooth device that supports the Hands-Free Profile, which allows for hands-free calling and control of a mobile phone, such as a car’s infotainment system or a wireless headset. It enables features like answering, making, and ending calls, as well as voice dialing and call waiting,…
-
CVE-2025-47353: About Automotive Software platform based on QNX (5th Nov 2025)
Preface: An automotive cockpit is the driver’s compartment, integrating all the controls and information displays needed to operate a vehicle, including the steering wheel, dashboard, instruments, and central displays. Background: To install QNX on a Qualcomm SA8775P chip, you will need the specific QNX Board Support Package (BSP) for that platform, as it contains the…
-
In-depth discussion of the basic knowledge of CAN BUS preventive control (30th Oct 2025)
Preface: Is the CAN bus still in use? While the CAN protocol was originally designed for road vehicles and is still primarily used there, the vehicle bus format has found its way into aircraft, aerospace, and rail systems. Background: CAN bus significantly reduces traditional cable connections by allowing multiple electronic control units (ECUs) to communicate…
-
CVE-2025-11678: About warmcat libwebsockets (Industrial network security – Are you worried about?) 23rd Oct 2025
Published: 2025-10-20 Preface: Contribute Automation Expert is a software-centric industrial automation platform that is vendor-agnostic and based on the IEC 61499 standard. It is designed to make industrial automation more agile, efficient, and flexible by decoupling hardware and software, which allows for the use of components from different manufacturers and simplifies the process of updating…
-
CVE-2025-33182 and CVE-2025-33177: About NVIDIA Jetson Linux and IGX OS (20-10-2025)
Official Updated 10/13/2025 09:19 AM Preface: Railway applications have traditionally relied on fixed-function embedded computers to perform tasks such as signaling, monitoring, and train control. To bridge this gap, rail operators and system integrators are turning to AI-driven edge computing to meet the growing demand for real-time processing and automation. Background: The Nvidia Jetson is…
-
CVE-2025-27053: Incorrect Calculation of Buffer Size in HLOS (17th Oct 2025)
Official Published: 10/06/2025 Preface: Microsoft partners with the Android ecosystem by enabling its PlayReady DRM technology for content protection on Android devices, both in apps and web browsers. This integration allows developers to protect premium content like live TV and video-on-demand (VOD) using Android’s Java DrmManagerClient API, while web browsers use the Encrypted Media Extensions…
-
CVE-2025-47347: Stack-based Buffer Overflow in Automotive Software platform based on QNX (14-10-2025)
Preface: QNX uses a 4KB page size by default for memory translation, where memory is organized into fixed-sized chunks called pages, which are the units the memory manager works with. However, newer versions of the QNX OS have introduced variable page sizes for improved performance, allowing for larger blocks of memory to be mapped with…