Companies and projects I've had the chance to work with over the years
A small selection of CVEs I reported — sorted by CVSS impact. The full list is available in the CVE section.
A critical vulnerability has been identified in the Yi IOT XY-3820 (v6.0.24.10) smart camera platform, specifically within its embedded daemon process. The service, exposed on TCP port 6789, fails to properly sanitize user-supplied input, enabling remote unauthenticated attackers to execute arbitrary commands present on the file system via path traversal techniques. Successful exploitation leads to unauthorized code execution with elevated privileges.
A critical Remote Command Execution (RCE) vulnerability has been discovered in the Yi IOT XY-3820 smart camera (firmware v6.0.24.10), affecting the cmd binary. While this binary is not invoked during normal camera operation, it can be manually triggered (either locally or via another vulnerability) to spawn a root-level command server on TCP port 999. Once active, the binary listens indefinitely and processes commands sent over the network, resulting in unauthenticated, root-level code execution.
This repository demonstrates a critical security vulnerability discovered in the LSC PTZ Dualband Camera. The flaw, located in the tuya_ipc_direct_connect function of the anyka_ipc process, allows remote arbitrary code execution when a specially crafted QR code is presented to the camera during Wi-Fi configuration.
Companies that were kind enough to acknowledge my research
