corpus.blog
41554 blogs · [ { "id": "01a0d5af-8554-70e4-82de-24a4df7cbd5d", "title": "Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL", "url": "https://blog.nns.ee/2026/09/24/oneplus-root/", "published_at": "2026-09-24T12:00:00+00:00" }, { "id": "01a08751-6570-701d-9ab5-af19a5e99462", "title": "Chaining multiple vulnerabilities in Project Zomboid to execute code on a multiplayer client", "url": "https://blog.nns.ee/2026/08/26/project-zomboid-vulns/", "published_at": "2026-08-26T12:45:00+00:00" }, { "id": "01a08751-6570-701d-9ab5-af19a6a50249", "title": "Bypassing the Sound Blaster's new firmware signature check", "url": "https://blog.nns.ee/2026/07/03/katana-badusb-fix/", "published_at": "2026-07-03T09:45:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3425a0df0c", "title": "Pwnd Blaster: Hacking your PC using your speaker without ever touching it", "url": "https://blog.nns.ee/2026/06/03/katana-badusb/", "published_at": "2026-06-03T12:45:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3425e6dff4", "title": "Reverse engineering the Creative Katana V2X soundbar to be able to control it from Linux", "url": "https://blog.nns.ee/2026/02/20/katana-v2x-re/", "published_at": "2026-02-20T12:45:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e34263de816", "title": "Solving Fossil SCM's CAPTCHA in 171 characters", "url": "https://blog.nns.ee/2026/01/29/fossil-captcha-solver/", "published_at": "2026-01-29T12:45:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3426e775b4", "title": "Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters", "url": "https://blog.nns.ee/2026/01/06/aike-ble/", "published_at": "2026-01-06T08:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342754d742", "title": "Bypassing dnsmasq dhcp-script limitations for command execution in config injection attacks", "url": "https://blog.nns.ee/2025/07/24/dnsmasq-injection-trick/", "published_at": "2025-07-24T08:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3428301a4e", "title": "Retrospective on hosting my blog inside an LTE modem, 4 years later", "url": "https://blog.nns.ee/2025/04/01/modem-blog-retrospective/", "published_at": "2025-04-01T08:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342907a731", "title": "When parameterization fails: SQL injection in Nim's db_postgres module using parameterized queries", "url": "https://blog.nns.ee/2025/03/28/nim-postgres-vulnerability/", "published_at": "2025-03-28T09:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3429d8c2ef", "title": "Symlinks as mount portals: Abusing container mount points on MikroTik's RouterOS to gain code execution", "url": "https://blog.nns.ee/2022/08/05/routeros-container-rce/", "published_at": "2022-08-05T06:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342a82db1c", "title": "Code execution as root via AT commands on the Quectel RG500Q-EA 5G modem", "url": "https://blog.nns.ee/2022/06/21/modem-rce2/", "published_at": "2022-06-21T05:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342b682bb1", "title": "Don't trust comments", "url": "https://blog.nns.ee/2022/01/31/dont-trust-comments/", "published_at": "2022-01-31T12:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342c6334ef", "title": "Code execution as root via AT commands on the Quectel EG25-G modem", "url": "https://blog.nns.ee/2021/04/03/modem-rce/", "published_at": "2021-04-03T12:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342d4f883d", "title": "This blog is now hosted on a GPS/LTE modem", "url": "https://blog.nns.ee/2021/04/01/modem-blog/", "published_at": "2021-04-01T08:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342e276c2a", "title": "Viewing and resetting the BIOS passwords on the RedmiBook 16", "url": "https://blog.nns.ee/2021/01/18/resetting-bios-password/", "published_at": "2021-01-18T02:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342e64527b", "title": "Patching ACPI tables to enable deep sleep on the RedmiBook 16", "url": "https://blog.nns.ee/2020/10/19/acpi-patching/", "published_at": "2020-10-19T02:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342e71af52", "title": "iopshell: A shell-like application for communicating with IOPSYS devices", "url": "https://blog.nns.ee/2019/05/28/iopshell/", "published_at": "2019-05-28T12:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342e837748", "title": "chroot shenanigans 2: Running a full desktop environment on an Amazon Kindle", "url": "https://blog.nns.ee/2019/04/14/chroot-shenanigans-2/", "published_at": "2019-04-14T17:00:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e342f7e7975", "title": "chroot shenanigans: Running Arch Linux on OpenWRT (LEDE) routers", "url": "https://blog.nns.ee/2019/03/21/chroot-shenanigans/", "published_at": "2019-03-21T17:45:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e343034edcf", "title": "Unsafe firewall includes allowing for remote code execution on Inteno's IOPSYS devices", "url": "https://blog.nns.ee/2018/12/26/firewall-includes/", "published_at": "2018-12-26T20:10:00+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3430a5ba73", "title": "Creating a key generator to reset a Hikvision IP camera's admin password", "url": "https://blog.nns.ee/2018/08/01/hikvision-keygen/", "published_at": "2018-08-01T16:11:30+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3431089fa5", "title": "From writing to /tmp to a root shell on Inteno IOPSYS", "url": "https://blog.nns.ee/2018/07/21/tmp-to-rce/", "published_at": "2018-07-21T16:20:31+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3431daf6a4", "title": "pwn910nd - abusing OpenWRT's printer server to become root", "url": "https://blog.nns.ee/2018/04/15/pwn910nd/", "published_at": "2018-04-15T23:20:09+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3432287586", "title": "Remote Code Execution vulnerability in Inteno's Iopsys", "url": "https://blog.nns.ee/2017/12/23/rce-inteno-iopsys/", "published_at": "2017-12-23T14:20:09+00:00" }, { "id": "01a08751-6571-7309-9e15-7e3432393246", "title": "CVE-2017-11361 post-remedy: Is it fixed?", "url": "https://blog.nns.ee/2017/07/21/post-remedy-cve-2017-11361/", "published_at": "2017-07-21T12:01:09+00:00" }, { "id": "01a08751-6571-7309-9e15-7e343328e80a", "title": "Inteno misconfigured ACLs leading to information disclosure and logging in as root", "url": "https://blog.nns.ee/2017/07/17/cve-2017-11361/", "published_at": "2017-07-17T12:07:09+00:00" }, { "id": "01a08751-6572-730e-928c-d14e8a67e3ea", "title": "Installing custom OpenWRT on an Inteno (DG301) router", "url": "https://blog.nns.ee/2017/07/13/flashing-openwrt-on-inteno-dg301/", "published_at": "2017-07-13T11:00:09+00:00" }, { "id": "01a08751-6572-730e-928c-d14e8b006264", "title": "ksoft's Easy Auto Refresh extension is selling your data", "url": "https://blog.nns.ee/2017/06/21/easy-auto-refresh-data-harvesting/", "published_at": "2017-06-21T16:00:00+00:00" }, { "id": "01a08751-6572-730e-928c-d14e8b2318b9", "title": "Restoring stock BIOS on a Braswell Chromebook with a broken rom", "url": "https://blog.nns.ee/2017/06/16/restore-stock-bios-braswell/", "published_at": "2017-06-16T12:36:09+00:00" } ] posts Claim your blog
Back to blog.nns.ee
Blog · corpus.blog/blogs/blog.nns.ee/posts

blog.nns.ee

blog.nns.ee

2026

Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HALoriginal ↗
24 Sept 2026
Chaining multiple vulnerabilities in Project Zomboid to execute code on a multiplayer clientoriginal ↗
26 Aug 2026
Bypassing the Sound Blaster's new firmware signature checkoriginal ↗
3 Jul 2026
Pwnd Blaster: Hacking your PC using your speaker without ever touching itoriginal ↗
3 Jun 2026
Reverse engineering the Creative Katana V2X soundbar to be able to control it from Linuxoriginal ↗
20 Feb 2026
Solving Fossil SCM's CAPTCHA in 171 charactersoriginal ↗
29 Jan 2026
Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scootersoriginal ↗
6 Jan 2026

2025

Bypassing dnsmasq dhcp-script limitations for command execution in config injection attacksoriginal ↗
24 Jul 2025
Retrospective on hosting my blog inside an LTE modem, 4 years lateroriginal ↗
1 Apr 2025
When parameterization fails: SQL injection in Nim's db_postgres module using parameterized queriesoriginal ↗
28 Mar 2025

2022

Symlinks as mount portals: Abusing container mount points on MikroTik's RouterOS to gain code executionoriginal ↗
5 Aug 2022
Code execution as root via AT commands on the Quectel RG500Q-EA 5G modemoriginal ↗
21 Jun 2022
Don't trust commentsoriginal ↗
31 Jan 2022

2021

Code execution as root via AT commands on the Quectel EG25-G modemoriginal ↗
3 Apr 2021
This blog is now hosted on a GPS/LTE modemoriginal ↗
1 Apr 2021
Viewing and resetting the BIOS passwords on the RedmiBook 16original ↗
18 Jan 2021

2020

Patching ACPI tables to enable deep sleep on the RedmiBook 16original ↗
19 Oct 2020

2019

iopshell: A shell-like application for communicating with IOPSYS devicesoriginal ↗
28 May 2019
chroot shenanigans 2: Running a full desktop environment on an Amazon Kindleoriginal ↗
14 Apr 2019
chroot shenanigans: Running Arch Linux on OpenWRT (LEDE) routersoriginal ↗
21 Mar 2019

2018

Unsafe firewall includes allowing for remote code execution on Inteno's IOPSYS devicesoriginal ↗
26 Dec 2018
Creating a key generator to reset a Hikvision IP camera's admin passwordoriginal ↗
1 Aug 2018
From writing to /tmp to a root shell on Inteno IOPSYSoriginal ↗
21 Jul 2018
pwn910nd - abusing OpenWRT's printer server to become rootoriginal ↗
15 Apr 2018

2017

Remote Code Execution vulnerability in Inteno's Iopsysoriginal ↗
23 Dec 2017
CVE-2017-11361 post-remedy: Is it fixed?original ↗
21 Jul 2017
Inteno misconfigured ACLs leading to information disclosure and logging in as rootoriginal ↗
17 Jul 2017
Installing custom OpenWRT on an Inteno (DG301) routeroriginal ↗
13 Jul 2017
ksoft's Easy Auto Refresh extension is selling your dataoriginal ↗
21 Jun 2017
Restoring stock BIOS on a Braswell Chromebook with a broken romoriginal ↗
16 Jun 2017