# Neodyme

> Make security your strength. We help secure software with deep-dive audits, cutting-edge research, and trainings that propel your team to the next level.

Security is difficult. Especially, when the thing you're trying to secure is complex already — like a hardware product, a blockchain protocol, a computer network, or even a whole business. To securely build and maintain such complex things you need a certain type of people. People who thrive in complexity, who love to play around with technology, and who don’t stop exploring until they fully understand every aspect of it. That's us.

Neodyme AG is an IT security company founded in 2021 and based in Garching bei München, Germany. It offers smart contract and blockchain audits, penetration tests, and security trainings, backed by deep-dive security research. We like to push the boundaries of security: Our team is dedicated to continuously advancing the forefront of research in the realm of hacking. We have presented talks and papers at renowned conferences, participated in top hacking competitions such as DefCon CTF, or Pwn2Own, and have multiple team members pursuing their PhD.

Contact: contact@neodyme.io, +49 89 244184570.

## Services

- [Smart Contract Audits](https://neodyme.io/en/blockchain): Our team is known for finding many critical vulnerabilities in smart contracts. Get your contracts audited by our experts with a proven track record.
- [Core Blockchain Audits](https://neodyme.io/en/blockchain): We offer blockchain services such as smart contract audits, or core blockchain audits. Please contact us for a quote. Here you can also find a list of public reports.
- [Penetration Testing](https://neodyme.io/en/pentests): We offer pentests and red team engagements with a trained team. Our Pentesting team consists of renowned experts with top results in hacking competitions, industry standard certifications, and the hacker mindset.
- [Automotive Security](https://neodyme.io/en/pentests): Our automotive experts have years of experience in securing electrical components of vehicles.
- [Security Trainings](https://neodyme.io/en/trainings): We offer some of the best trainings in the industry. We have a wide selection of topics: From standard awareness campains to state-of-the-art embedded exploit development. Contact us for a custom offer!

## Company

- [About](https://neodyme.io/en/about): Our team met through a series of hacking competitions called CTFs. There, we had a lot of fun competing and collaborating while finding vulnerabilities, breaking encryption, reverse engineering complicated algorithms, and much more. Through the years, many of our team members have won national and international CTF competitions, and keep ranking highly among some of the hardest CTF events world-wide. In 2020, Leo and Hendrik started experimenting with validators and became active members in the early Solana community. With the prospect of an interesting technical challenge and bug bounties, they quickly encouraged other members of their CTF team to look for security issues in Solana. The result was so successful that after reporting several bugs, in 2021, the Solana Foundation wanted to contract us for source code auditing. And just like that, Neodyme was born. Ever since, we have prevented a possible loss of more than $50B in TVL on the Solana blockchain.
- [Sampled Public Reports](https://neodyme.io/en/reports): Selected public audit reports.

## Blog

- [Pulling the right strings for RCE on a Puppet](https://neodyme.io/en/blog/puppet_rce): 2026-11-03. In preparation for a red team engagement we found two critical CVSS 9+ vulnerabilities in Puppet, dating back to 2021. They allow RCE on the puppet management server in a default configuration. Additionally, we discovered a Puppet host impersonation vulnerability in a non-default but commonly used configuration. Both vulnerabilities were responsibly disclosed to the vendors, who has since addressed them in newer versions of Puppet.
- [Keyless Entry: Hacking SwitchBot Smart Locks](https://neodyme.io/en/blog/switchbot): 2026-10-26. We've identified multiple vulnerabilities in devices of the popular SwitchBot Lock Pro smart lock series. The most critical, a cryptographic flaw in their bluetooth communication, allows everyone to silently open smart locks in a software-only attack.
- [Lenovo DCC: Part 2 - Trusted IPC and a Malicious Firmware Update](https://neodyme.io/en/blog/lenovo_dcc_lpe_fwupdate): 2026-03-24. The [Lenovo Display Control Center](https://support.lenovo.com/de/de/downloads/ds547223-lenovo-display-control-center-thinkcolor), commonly deployed in Windows enterprise environments, could be used for local privilege escalation. In the first part of this series, we have presented two ways how to gain local administrative access. In this post, we dive into IPC communication and how to exploit trusted IPC communication from a low privileged service process to get admin privileges in a different way.
- [Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC](https://neodyme.io/en/blog/drone_hacking_part_1): 2026-01-05. Desoldering a drone's flash chip and reconstructing the firmware from broken data.
- [Diving into the depths of Widevine L3](https://neodyme.io/en/blog/widevine_l3): 2025-10-23. This post explores various approaches to attacking Widevine L3, a DRM system commonly used by streaming services. We analyzed the Android library and instrumented it dynamically to extract the keybox before finally deobfuscating it.
- [Pwn2Own Ireland 2024: QNAP Qhora-322](https://neodyme.io/en/blog/pwn2own-2024_qhora): 2025-10-21. In 2024, we competed as team Neodyme in the Pwn2Own Ireland contest, targeting the "SOHO Smashup" category and all available printers. For our entry, we focused on the QNAP QHora-322 router, successfully exploiting it to pivot into the Canon imageCLASS MF656Cdw printer. This post details the vulnerabilities we discovered, our methodology (from working with a factory-sealed router to achieving remote access via the WAN port without authentication) and how we ultimately compromised the connected printer.
- [Lenovo DCC: Part 1 - A simple ACL Exploit](https://neodyme.io/en/blog/lenovo_dcc_lpe_logic): 2025-10-01. The Lenovo Display Control Center (DCC), widely deployed in Windows enterprise environments, contained a critical local privilege escalation vulnerability enabling unauthorized elevation to administrative privileges. This post examines the Lenovo DCC architecture, analyzes underlying security flaws through IDA Pro and ProcMon analysis, and presents two distinct exploitation methodologies for achieving local administrative access: a race condition-based approach and a junction path exploitation technique.
- [Building Our Own Post-Quantum FIDO Token](https://neodyme.io/en/blog/pqc-fido): 2025-09-16. We have built our own FIDO2 token based on post-quantum crypto. Here is how.
- [Did You Train on My Voice? Exploring Privacy Risks in ASR](https://neodyme.io/en/blog/membership_inference): 2025-07-02. This post explores a recent research paper on membership inference attacks targeting Automatic Speech Recognition (ASR) models. It breaks down how subtle signals like input perturbation and model loss can reveal whether a voice recording was used during training, helping to check for privacy and compliance concerns. For cybersecurity professionals, we highlight why machine learning models should be treated as potential attack surfaces.
- [Your router might be a security nightmare: Tales from Pwn2Own Toronto 2022](https://neodyme.io/en/blog/pwn2own-2022_router_rce): 2025-06-06. Three years ago, Neodyme took aim the "SOHO Smashup" category at Pwn2Own Toronto 2022, targeting a Netgear RAX30 router and an HP M479fdw printer. We successfully gained remote code execution on both devices, pivoting from the router to the printer. In this post, we dive into the technical details of our router exploitation journey, resulting in reliable code execution via a MAC address lookup service.
- [Riverguard: Mutation Rules for Finding Vulnerabilities](https://neodyme.io/en/blog/riverguard_3_fuzzcases): 2025-05-28. Riverguard, the first line of defense for all Solana contracts
- [Pwn2Own Ireland 2024: Canon imageCLASS MF656Cdw](https://neodyme.io/en/blog/pwn2own-2024_canon_rce): 2025-05-22. This blogpost starts a series about various exploits at Pwn2Own 2024 Ireland (Cork). This and the upcoming posts will detail our research methodology and journey in exploiting different devices. We start with some EXIF basics and end up with shellcode execution after reconfiguring the MMU of the RTOS.
- [HTML to PDF Renderer: A tale of local file access and shellcode execution](https://neodyme.io/en/blog/html_renderer_to_rce): 2025-05-02. In a recent engagement, we found an HTML to PDF converter API endpoint that allowed us to list local directories and files on a remote server. One of the PDF files we created, revealed that the converter was using a .NET renderer framework based on Chromium 62. With this, we were able to gain remote code execution by porting a Chromium 62 exploit to the particular version of the renderer.
- [The Key to COMpromise - Writing to the Registry (again), Part 4](https://neodyme.io/en/blog/com_hijacking_4): 2025-02-26. In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all relevant background information, describe our approach to reverse engineering the products' internals, and explain how we finally exploited the vulnerabilities. We hope to shed some light on this undervalued attack surface.
- [The Key to COMpromise - Downloading a SYSTEM shell, Part 3](https://neodyme.io/en/blog/com_hijacking_3): 2025-02-12. In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all relevant background information, describe our approach to reverse engineering the products' internals, and explain how we finally exploited the vulnerabilities. We hope to shed some light on this undervalued attack surface.
- [Introducing HyperHook: A harnessing framework for Nyx](https://neodyme.io/en/blog/hyperhook): 2025-02-05. In this post, we introduce HyperHook, a harnessing framework for snapshot-based fuzzing for user-space applications using Nyx. HyperHook simplifies guest-to-host communication and automates repetitive tasks, making the fuzzing process more efficient.
- [The Key to COMpromise - Abusing a TOCTOU race to gain SYSTEM, Part 2](https://neodyme.io/en/blog/com_hijacking_2): 2025-01-29. In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all relevant background information, describe our approach to reverse engineering the products' internals, and explain how we finally exploited the vulnerabilities. We hope to shed some light on this undervalued attack surface.
- [Windows BitLocker -- Screwed without a Screwdriver](https://neodyme.io/en/blog/bitlocker_screwed_without_a_screwdriver): 2025-01-17. Breaking up-to-date Windows 11 BitLocker encryption -- on-device but software-only
- [On Secure Boot, TPMs, SBAT, and downgrades -- Why Microsoft hasn't fixed BitLocker yet](https://neodyme.io/en/blog/bitlocker_why_no_fix): 2025-01-17. On Secure Boot, TPMs, SBAT and Downgrades -- Why Microsoft hasn't fixed BitLocker yet
- [The Key to COMpromise - Pwning AVs and EDRs by Hijacking COM Interfaces, Part 1](https://neodyme.io/en/blog/com_hijacking_1): 2025-01-15. In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all relevant background information, describe our approach to reverse engineering the products' internals, and explain how we finally exploited the vulnerabilities. We hope to shed some light on this undervalued attack surface.
- [Solana Consensus - From Forks to Finality](https://neodyme.io/en/blog/solana_consensus): 2024-12-16. Explore Solana Consensus
- [From Guardian to Gateway: The Hidden Risks of EDR Vulnerabilities](https://neodyme.io/en/blog/wazuh_rce): 2024-11-21. Explore the hidden risks within security software as we dive into vulnerabilities of Wazuh, a popular EDR solution. This post reveals how even trusted tools can become targets, highlighting the importance of robust defenses for security systems themselves.
- [RCE on the HP M479fdw printer](https://neodyme.io/en/blog/pwn2own-2022_printer_rce): 2024-10-10. Two years ago, Neodyme targeted the "SOHO Smashup" chain at Pwn2Own Toronto 2022, featuring a Netgear RAX30 router and an HP M479fdw printer and successfully gained remote code execution on both devices, pivoting from the router to the printer. This post covers the technical aspects of our first printer exploitation journey, resulting in reliable code execution via the printer discovery service.
- [SPL Token-2022: Don't shoot yourself in the foot with extensions](https://neodyme.io/en/blog/token-2022): 2024-09-10. We go through the new functionalites, potential security pitfalls, and best practices for secure implementation of the new token extensions.
- [Riverguard: How to Get Access to Findings for Your Contract](https://neodyme.io/en/blog/riverguard-onboarding): 2024-07-23. Riverguard searches for potential vulnerabilities in all programs deployed on Solana mainnet. Here's how to get access to all findings in your smart contract(s), free of charge.
- [Riverguard: Fishing for Loss of Funds in the Stream of Solana Transactions](https://neodyme.io/en/blog/riverguard_1_intro): 2024-02-29. Riverguard, the free first line of defense for all Solana contracts
- [Hidden GitHub Commits and How to Reveal Them](https://neodyme.io/en/blog/github_secrets): 2024-02-16. We have created a tool for GitHub that can reveal commits that potentially contain sensitive information and are not accessible via the public Git history, but that may be of interest or were intentionally deleted.
- [How to Hack a DAO](https://neodyme.io/en/blog/how_to_hack_a_dao): 2024-01-24. DAOs add a social layer to the otherwise technical execution of blockchain transactions. By exploiting common misconceptions about how they actually work, attackers can 'hack a DAO'.
- [CS:GO: From Zero to 0-day](https://neodyme.io/en/blog/csgo_from_zero_to_0day): 2023-05-13. We identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to our malicious python CS:GO server. This post details our journey through the CS:GO binary and conducts a technical deep dive into various identified bugs. We conclude by presenting a proof of concept (POC) exploit that leverages four different logic bugs into remote code execution in the game's client, triggered when a client connects to the server.
- [Nonce Upon a Time, or a Total Loss of Funds - Exploring Solana Core Part 3](https://neodyme.io/en/blog/nonce-upon-a-time): 2023-03-10. This blog post details the first ever loss-of-funds bug we found in Solana Core. The bug would have allowed us to write arbitrary data to any account on the Solana Blockchain. This has many devastating implications. An attacker with this power can: - Mint any amount of any token - Steal other accounts' Sol, or tokens - Change ownership of any NFT - Delete their liabilities in any lending protocol In short: we could have done pretty much anything we wanted, short of minting new SOL.
- [Secure Randomness: From Zero to Verifiable Delay Functions, Part 2](https://neodyme.io/en/blog/secure-randomness-part-2): 2022-11-14. For many different purposes, the blockchain space needs a trustless, general-purpose source of randomness. In the first post, we saw that almost all sources of general on-chain randomness that are currently in use have fundamental flaws (the severity of which varies). So how can we fix this? In this post, we focus on employing Verifiable Delay Functions (VDFs) for on-chain randomness. We describe what VDFs are and why it's not clear they even exist. We also discuss one of the most promising candidates for a VDF and examine what difficulties an on-chain implementation of a scheme using that VDF candidate would face. Finally, we also spend some time examining a VDF implementation that is already being used in practice, namely in the consensus algorithm of the Chia blockchain.
- [Stake², or How To Cheat The Staking Mechanism - Exploring Solana Core Part 2](https://neodyme.io/en/blog/solana_core_2): 2022-10-24. Over the past two years, we have spent a lot of time reviewing Solana core code, reporting over 80 bugs of varying severity. This is the second in a series of blog posts detailing what we found the most interesting vulnerabilities that we reported in Solana Core. All bugs were responsibly disclosed under the [Solana bug bounty program](https://github.com/solana-labs/solana/blob/master/SECURITY.md) and subsequently fixed. With this, we hope to inspire more whitehats to keep the ecosystem safe. In this post, we present a vulnerability that would have allowed us to give an unlimited amount of stake to our own or a cooperating validator.
- [Secure Randomness: From Zero to Verifiable Delay Functions, Part 1](https://neodyme.io/en/blog/secure-randomness-part-1): 2022-10-19. A secure source of randomness is one of the most critical components of many decentralized applications. However, perhaps surprisingly, there is currently no on-chain source of randomness that is truly trustless. Almost all solutions that have been used in practice are either fundamentally broken or require the participants involved to trust each other or a third party. Why is that? In this two-part series, we'll discuss the different attempts to construct a secure source of randomness, and why all currently known solutions have fundamental shortcomings in some aspect.
- [Why Auditing the Code is Not Enough: A Discussion on Solana Upgrade Authorities](https://neodyme.io/en/blog/solana_upgrade_authority): 2022-06-20. Recently, there’s been a lot of buzz around a DAO vote of Solend – one of Solana’s largest lending projects. It seeks to enact restrictions on large positions, and to temporarily take control of an existing user's position in order to liquidate it in a controlled fashion. This can be done by upgrading the smart contract's code. But wait! Aren't smart-contracts supposed to be immutable? Only in a perfect world. No code is perfect and smart contracts aren't either, so it can be necessary to change or fix them. This is called a program upgrade. In this post, we'll give an overview of one of the most fundamental and yet somehow often-overlooked aspects of the security of a smart contract, namely: Who has the power to initiate program upgrades? How can users be sure that the developers don't make undesired changes? Or even worse, just run off with their money?
- [How a Little-Known Solana Feature Made Program Vaults Unsafe - Exploring Solana Core Part 1](https://neodyme.io/en/blog/solana_core_1): 2022-06-01. Over the past year and a half, we have spent a lot of time looking at the Solana core code, reporting over 80 bugs of varying severity. This blog post is the first in a series detailing the most interesting vulnerabilities we found and reported in Solana core, hopefully inspiring more whitehats to keep the ecosystem safe. All bugs presented here were responsibly disclosed under the [Solana bug bounty program](https://github.com/solana-labs/solana/blob/master/SECURITY.md) and are now fixed.
- [How to Become a Millionaire, 0.000001 BTC at a Time](https://neodyme.io/en/blog/lending_disclosure): 2021-12-03. We recently discovered a critical bug in the token-lending contract of the Solana Program Library (SPL). This blog post details our journey from discovery, through exploitation and coordinated disclosure, and finally the fix. The total TVL at risk was about 2.600.000.000 USD. Some low-value coins are not economically viable to steal, but the potential profit was easily in the hundreds of millions. The bug was fixed, and dapps updated promptly to close the vulnerability.
- [Solana Smart Contracts: Common Pitfalls and How to Avoid Them](https://neodyme.io/en/blog/solana_common_pitfalls): 2021-08-20. In this post, we want to raise awareness about the five most common vulnerabilities in Solana contracts that we keep finding during our audits. We'll keep the vulnerability descriptions short and concise and provide a simplified example as well as a TL;DR for each vulnerability so that you can easily reference them while coding.
- [Reversing a Fingerprint Reader Protocol](https://neodyme.io/en/blog/fingerprint_reversing): 2021-05-27. The sensor uses TLS-PSK over USB. We overwrite the PSK and are able to read images.
- [MacOS: Unauthd - Logic bugs FTW](https://neodyme.io/en/blog/unauthd_logic_bugs_ftw): 2020-07-31. This blog post is about a MacOS LPE chain I wrote and reported back in February. It features three logic bugs to go from user to root with System Integrity Protection (SIP) bypass to kernel. Since I'm not exploiting any memory corruptions or other vulnerabilities that aren't 100% deterministic, this chain is fully reliable which I think is cool ;). It runs on MacOS < 10.15.5

## Security Advisories

- [CVE-2026-114516 ‒ Etherpad Pre-auth Arbitrary File Read](https://neodyme.io/en/advisories/cve-2026-114516): 2026-10-30, CVE-2026-114516. An unauthenticated path-traversal / arbitrary-file-read vulnerability in Etherpad's `/static/*` handler allows a remote, unauthenticated user to read files on the server's filesystem that are accessible to the operating-system user running Etherpad.
- [CVE-2026-118609 ‒ Alpine iLX-F511 Android Auto Connection Handler Remote Code Execution Vulnerability (Pwn2Own)](https://neodyme.io/en/advisories/cve-2026-118609): 2026-10-30, CVE-2026-118609. This vulnerability allows physically present unauthenticated attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices.
- [CVE-2026-8374 ‒ Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication](https://neodyme.io/en/advisories/cve-2026-8374): 2026-10-26, CVE-2026-8374. Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
- [CVE-2026-18279 ‒ Sony XAV-9500ES Buffer Overflow Remote Code Execution Vulnerability (Pwn2Own)](https://neodyme.io/en/advisories/cve-2026-18279): 2026-07-29, CVE-2026-18279. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.
- [CVE-2026-43914 ‒ Brute-Force Protection Bypass in Vaultwarden via Email 2FA Endpoint](https://neodyme.io/en/advisories/cve-2026-43914): 2026-05-20, CVE-2026-43914. Vaultwarden is a Bitwarden-compatible server written in Rust. In versions prior to 1.35.4, the login brute-force protection can be bypassed when email 2FA is enabled on the instance. The unprotected `send_email_login` endpoint acts as an oracle for valid username-password combinations, allowing an attacker to brute-force passwords without rate-limiting. This affects all users on the instance, even those who have not configured email 2FA themselves.
- [CVE-2026-28705 ‒ Arbitrary File Write via Path Traversal in Gitea dump-repo Command](https://neodyme.io/en/advisories/cve-2026-28705): 2026-05-06, CVE-2026-28705. Gitea is an open-source self-hosted Git service. In versions prior to 1.25.5, the `dump-repo` CLI command is vulnerable to a path traversal attack allowing arbitrary file writes with attacker-controlled content.
- [CVE-2026-41220 ‒ Out of bounds write in Acronis Device Lock Kernel Driver](https://neodyme.io/en/advisories/cve-2026-41220): 2026-05-06, CVE-2026-41220. The DeviceLockDllDrv0.sys kernel driver shipped with Acronis Device Lock allows an unprivileged user to write to an arbitrary kernel address potentially leading to LPE.
- [CVE-2026-41250 ‒ Cross-Site-Scripting (XSS) in Taiga](https://neodyme.io/en/advisories/cve-2026-41250): 2026-05-06, CVE-2026-41250. Taiga is an open-source project management tool. In taiga-front versions up to 6.9.0, the `textToHTML` function insufficiently sanitizes user-controlled input, allowing injection of JavaScript event attributes via permitted HTML tags. This can be exploited to steal session tokens from local storage. The issue has been fixed in version 6.9.1.
- [CVE-2026-4682 ‒ HP DeskJet 2855e JobStatusEvent Stack-based Buffer Overflow RCE](https://neodyme.io/en/advisories/cve-2026-4682): 2026-04-17, CVE-2026-4682. A stack buffer overflow vulnerability in SOAP request handling on the JobStatusEvent endpoint allows remote code execution.
- [CVE-2025-14237 ‒ Canon imageCLASS MF654Cdw TTF Parsing Integer Overflow RCE](https://neodyme.io/en/advisories/cve-2025-14237): 2026-04-15, CVE-2025-14237. An integer overflow in the TTF parser leads to a heap under allocation, resulting in remote code execution.
- [CVE-2026-2040 ‒ PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability](https://neodyme.io/en/advisories/cve-2026-2040): 2026-03-23, CVE-2026-2040. The TrackerUpdate process loads libraries from an unsecured location, leading to privilege escalation.
- [CVE-2025-59938 ‒ Heap Buffer Overflow in wazuh-analysisd](https://neodyme.io/en/advisories/cve-2025-59938): 2025-09-26, CVE-2025-59938. Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions >=3.8.0 through <4.11.0, wazuh-analysisd is vulnerable to a heap buffer overflow when parsing XML elements from Windows EventChannel messages.
- [CVE-2025-6812 ‒ Parallels Client Local Privilege Escalation Vulnerability](https://neodyme.io/en/advisories/cve-2025-6812): 2025-07-07, CVE-2025-6812. The AppServer service installed with Parallel Client searches for an OpenSSL config file in an unsecured location, which allowed low privileged users to escalate their privileges.
- [CVE-2025-47962 ‒ Improper Access Control in Windows SDK](https://neodyme.io/en/advisories/cve-2025-47962): 2025-06-10, CVE-2025-47962. The service `IpOverUsbSvc` installed with the Windows SDK had weak permissions on it's installation folder, which allowed low privileged users to escalate their privileges to `SYSTEM`.
- [CVE-2025-1865 ‒ Local Privilege Escalation in Virtual CloneDrive Kernel Driver](https://neodyme.io/en/advisories/cve-2025-1865): 2025-04-04, CVE-2025-1865. Virtual CloneDrive allows users to mount ISO files and other disk image formats as virtual drives on their computer. Its kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows creating files at arbitrary locations with full user control, ultimately allowing for privilege escalation to `SYSTEM`.
- [CVE-2024-41121 ‒ Privilege Escalation via Custom Workspace](https://neodyme.io/en/advisories/cve-2024-41121): 2024-07-19, CVE-2024-41121. Woodpecker is a simple yet powerful CI/CD engine with great extensibility. However, a vulnerability was identified that allows any user with permission to create workflows and trigger pipeline runs to takeover the host. This vulnerability poses two potential risks: 1. Malicious workflows could lead to a host takeover of the agent executing the workflow. 2. Attackers could extract sensitive secrets that are typically to the plugins, by overwriting their entry points. These issues have been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- [CVE-2024-36302 ‒ Local Privilege Escalation in Trend Micro Apex One](https://neodyme.io/en/advisories/cve-2024-36302): 2024-06-06, CVE-2024-36302. Trend Micro Apex One is a security product that protects endpoints from malware and detects attacks. The fixed vulnerability enabled attackers with existing access to a system to elevate their privileges to `SYSTEM`.
- [CVE-2023-50260 ‒ Command Injection via Active Responses](https://neodyme.io/en/advisories/cve-2023-50260): 2024-05-01, CVE-2023-50260. Wazuh is an "Open Source Security Platform" that provides agent-based security monitoring for Unix and Windows clients. This vulnerability affects the Active Response feature that can automatically trigger actions in response to alerts. The specific vulnerability is in the handling of IP address arguments. The problem results from the lack of proper validation of JSON messages. An attacker could exploit this vulnerability to run code in the context of root to escalate privileges or to pivot from the management server to client systems.
- [CVE-2023-7241 ‒ Local Privilege Escalation in Webroot Endpoint Protection](https://neodyme.io/en/advisories/cve-2023-7241): 2024-05-01, CVE-2023-7241. Webroot Endpoint Protection is a security product that protects endpoints from malware and detects attacks. The fixed vulnerability enabled attackers with existing access to a system to elevate their privileges to `SYSTEM`.
- [CVE-2024-24912 ‒ Local Privilege Escalation in Check Point Harmony](https://neodyme.io/en/advisories/cve-2024-24912): 2024-05-01, CVE-2024-24912. Check Point Harmony is a security product that protects endpoints from malware and detects attacks. The fixed vulnerability enabled attackers with existing access to a system to elevate their privileges to `SYSTEM`.
- [CVE-2024-32038 ‒ Heap-based Buffer Overflow in Event Decoder](https://neodyme.io/en/advisories/cve-2024-32038): 2024-04-25, CVE-2024-32038. Wazuh is a "Open Source Security Platform" that provides agent based security monitoring for Unix and Windows clients. This vulnerability is a heap-based buffer overflow in the event decoder of the "Analysis Engine", a component of the management server. It could allow unauthenticated attackers to execute arbitrary commands on the Wazuh management server.
- [CVE-2023-6154 ‒ Local Privilege Escalation in Bitdefender Total Security](https://neodyme.io/en/advisories/cve-2023-6154): 2024-04-01, CVE-2023-6154. Bitdefender Total Security is a security product that protects endpoints from malware and detects attacks. The fixed vulnerability enabled attackers with existing access to a system to elevate their privileges to `SYSTEM`.
- [CVE-2024-6510 ‒ Local Privilege Escalation in AVG Internet Security](https://neodyme.io/en/advisories/cve-2024-6510): 2024-02-08, CVE-2024-6510. AVG Internet Security is a security product that protects endpoints from malware. The fixed vulnerability enabled attackers with existing access to a system to elevate their privileges to `SYSTEM`.

## Optional

- [RSS feed](https://neodyme.io/rss.xml)
- [Sitemap](https://neodyme.io/sitemap-index.xml)
- [BlueSky](https://bsky.app/profile/neodyme.io)
- [Github](https://github.com/neodyme-labs)
- [LinkedIn](https://linkedin.com/company/neodyme-ag)
- [Mastodon](https://infosec.exchange/@neodyme/)
- [X](https://x.com/Neodyme)