Unitree DDS RCE, webOS Zero-Click, and Falcon HS Exploitation
KVM SEV-SNP heap corruption, router supply-chain implants, and rolling-shutter key recovery
ZeroDayCommission is a weekly, high-signal security briefing by OrbitCurve, focused on niche offensive and research-heavy domains: fault injection, MCU exploitation, microarchitecture, hypervisors, compilers, embedded systems, and hardware reverse engineering.
We curate material you can use: new primitives, reproducible PoCs, practical lab setups, and techniques that transfer across targets. No fluff, just this issue's best links, what changed, and why it matters.
Byte Brief
From DDS Packets to Robot Shells: Two RCEs in Unitree Go2
Boschko Security details two code-execution paths in Unitree's Go2 robot dog. CVE-2026-27509 abuses the rt/api/programming_actuator/* DDS DataWriter to execute arbitrary Python as root on firmware v1.1.7. CVE-2026-27510 reaches the same actuator_manager on v1.1.11 by modifying Blockly action blocks stored in the Android application's local database. Binding the modified action to a physical controller button turns the payload into a reusable trigger. Unitree shipped fixes in v1.1.13, although the writeup notes a separate update path for EDU devices.
-> https://boschko.ca/unitree-go2-rce/
LG webOS TV Zero-Click RCE
DelspoN chains an SSG R2R pairing bypass, a privileged browser-to-native bridge, and unsigned IPK sideloading into unauthenticated LAN command execution on LG webOS TVs. The attack requires no interaction at the display. The interesting part is not a single memory-corruption primitive, but the composition of weak trust transitions across second-screen pairing, a privileged web runtime, and native package installation.
-> https://delspon.github.io/posts/en/lg-webos-tv-zero-click-rce/
KVM SEV-SNP Page State Change Heap Corruption
CVE-2026-53360 is a repeatable heap out-of-bounds read/write in KVM's SEV-SNP Page State Change handler. A malicious encrypted guest can create a mismatch between the allocated buffer size and the number of entries processed by the host, allowing it to walk beyond the allocation, corrupt host-kernel heap objects, and leak layout information across the VM boundary. The bug affected kernels with SNP PSC support from roughly v6.10 and was fixed in mainline commit db3f2195d293. The author also provides safe CTF exercises for practicing the primitive.
A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor
Jon Pry's preprint targets the Heavy Secure Falcon mode on NVIDIA's CMP 170HX, a GA100-based accelerator segmented below the A100. The root primitive is an overflow that can overwrite both control data and the writable reference used by the stack-canary check. Because the relevant microcode is deterministic, the exploit emulates it offline and constructs a valid continuation image that survives the function's own canary check before returning into the attack chain. The paper reports software defeat of the card's compute-rate, memory-capacity, and Gen1-to-Gen2 PCIe restrictions, with measured gains of roughly 31-62x compute, 8x capacity, and 2x link speed. Three other segmentation controls resisted the work, so this is not a claim of a universal unlock.
Operation CameraSwarm: More Than 14,000 Dahua Cameras Compromised
Hunt.io recovered a 407 MB operator environment from an exposed HTTP directory and reconstructed a campaign that compromised more than 14,500 Dahua cameras in 35 days. The 2,616-file corpus shows three exploitation paths operating in parallel: credential attacks, authentication-bypass techniques, and access through Dahua's cloud relay. The operator installed a persistent p2pwn account on 1,923 cameras, while 283 devices were reached by serial number alone. The report is valuable because it moves beyond a vulnerability description and exposes the tooling, workflow, infrastructure, persistence, and scale of a real camera-compromise operation.
-> https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised
Chinese Implants in the ZBT Router Supply Chain
VulnCheck traces multiple implants through firmware used by the white-label ZBT-WE826 router platform. DARKLANTERN exposes an unauthenticated WAN-reachable command path, while SPEAKINGSTONE phones home over UDP and supports plaintext instructions for shell execution, PPPoE credential theft, DNS hijacking, reverse SSH, and C2 updates. After registering an abandoned backup domain, the researchers received beacons from 392 devices, most of them a single China Mobile CPE model. FCC filings and reseller records show the underlying platform appearing under several brands, but the authors explicitly do not claim that every rebrand contains the implants.
-> https://www.vulncheck.com/blog/zbt-darklantern-speakingstone
YubiWorm: Turning a Trusted YubiKey into a Propagating Worm
YubiWorm is a proof of concept that reprograms a YubiKey into a USB-borne propagation mechanism using HID injection and OTP or static-password behavior. This is feature abuse rather than a YubiKey firmware exploit: the same token trusted for authentication can also enumerate as a keyboard and deliver commands. The useful takeaway is architectural. Hardware-backed authentication does not make every interface exposed by the hardware trustworthy, especially on systems where USB insertion implicitly authorizes HID input.
-> https://www.youtube.com/watch?v=rXy1WvPkXIM
Reads and Resources
Video-Based Cryptanalysis
This work turns commercial cameras into optical side-channel probes. Cryptographic operations change device power consumption, which can modulate the brightness or color of a power LED. By filling the frame with the LED and exploiting rolling shutter, the researchers increase the effective sampling rate from 60 measurements per second to roughly 60,000. They recover a 256-bit ECDSA key from a smart-card reader using a hijacked security camera 16 meters away, and a 378-bit SIKE key from a Galaxy S8 through the power LED of a USB speaker filmed by an iPhone 13 Pro Max. The indirect attack is the nastier result: a connected peripheral can become the optical leakage surface even when the target itself has no useful LED.
-> https://www.nassiben.com/video-based-crypta
The Risk of Fine-Tuned Open-Weight Models
A practical proof of concept shows how QLoRA fine-tuning can poison model behavior without malicious loader code. A 1.5B coding model inserts a calc.exe payload into otherwise useful generated programs, while a 7B model emits a real shell tool call when connected to an agent. The weights are the payload, so scanners focused on pickles, loader hooks, or obvious executable content can miss the behavior. The most useful finding is contextual: a generic scan of the agent-targeting model returned clean, but the backdoor appeared once the model was evaluated with the tool schema and interaction frame in which it had been trained to activate.
-> https://www.msecops.de/blog/posts/backdoored-llms/
Owning a Fire HD 10 with Four AI Models
Eric Pardee used four AI models to turn an old Mali GPU use-after-free, CVE-2022-38181, into a repeatable root chain for a 2021 Fire HD 10. The work moved through kernel extraction, patch-level comparison, exploit discovery, GPU primitive debugging, device-specific offset correction, and MediaTek page-table behavior. Root was then used to remove protected Amazon services that were repeatedly shutting down the tablet in kiosk use. The project cost $266.15 in model access and is most useful as a concrete record of where long-horizon model assistance accelerated research, where it produced fatal mistakes, and where hardware and kernel judgment still had to come from the human operator.
-> https://ericpardee.github.io/fire-hd-ownership/
Watch Your Kids: Hacking Children's Smartwatches
Nils Rollshausen takes apart an Xplora children's smartwatch from initial access through firmware and protocol reverse engineering. The resulting proof-of-concept work can read and write messages, manipulate the apparent location of the child, and take control of arbitrary watches. Beyond the exploit chain, the talk is useful for its treatment of vendor disclosure and remediation in a product category whose security claims are directly tied to physical safety and parental trust.
-> https://www.youtube.com/watch?v=gjcDzybT9W8
Emulating Kimsuky's Initial Access
This lab rebuilds a Kimsuky DEEP#DRIVE-style initial-access chain around a phishing-delivered LNK disguised as a document. The shortcut launches hidden PowerShell, retrieves staged scripts and payloads, displays a decoy PDF, executes from user-writable directories, and establishes scheduled-task persistence. The author also covers LNK target spoofing and the telemetry generated by the chain, including explorer.exe spawning PowerShell and unusual PowerShell-to-PDF-reader process ancestry. It is a compact adversary-emulation exercise with concrete Sysmon and Defender KQL detection value.
-> https://0x00sec.org/emulating-kimsukys-initial-access/
Root, Root... Boom
Tokala walks through reverse engineering a Wi-Fi camera to obtain root access. UART discovery provides visibility into the boot process, but shell access remains password-gated, forcing the investigation beyond the usual "found serial, therefore owned" stopping point. It is a compact case study in treating board access, console reconnaissance, authentication recovery, and the final privilege path as separate stages of embedded exploitation.
-> https://www.youtube.com/watch?v=t62JwzNWBEc
Old MacDonald Had a Breach: Cyber Risks on the Connected Farm
Dr. Melisa A. Joyner treats the modern farm as an "OT environment with cows," maps connected agriculture onto the Purdue model, and examines how SCADA, autonomous machinery, drones, robots, and satellite-linked services expand the attack surface. The talk is useful because it places hardware and embedded security inside a production system where digital compromise can affect yield, animal welfare, equipment safety, and the food supply rather than only data confidentiality.
-> https://www.youtube.com/watch?v=Rr5CqQk86lE
Archive Pick: Chip.Fail - Glitching the Silicon of the Connected World
Thomas Roth and Josh Datko demonstrate practical fault injection against popular IoT processors using less than $100 of equipment and release supporting software and hardware tooling. Although the talk originated at Black Hat USA 2019, it remains useful for understanding low-cost glitch-lab construction, processor power-domain preparation, flash and RAM fault models, and the difference between a security guarantee in a datasheet and the device's behavior under unstable execution.
-> https://www.youtube.com/watch?v=CX71p_qcCxY
Archive Pick: Screaming Channels
Screaming Channels shows how a mixed-signal system-on-chip can transmit information about its own digital computation. Leakage from digital logic couples into the analog and RF path, mixes with the radio carrier, is amplified, and leaves through the normal antenna. The result can extend electromagnetic side-channel collection beyond the range expected from direct near-field probing, including on Bluetooth- and Wi-Fi-class devices. The talk remains a strong reference for researchers threat-modeling cryptography inside radio-equipped embedded systems.
-> https://www.youtube.com/watch?v=K7wqwOzD1Yw
Tooling and More
NSA and DoW Microelectronics: ASIC Best Practices Threat Catalog
This August 2026 threat catalog maps intentional hardware-assurance threats across the lifecycle of a digital single-die ASIC. Its 18 threat descriptions cover requirements, development IT, EDA tools, third-party IP, HDL and scripts, netlists, PDKs, physical design, tapeout, wafer manufacture and test, personalization, dicing, packaging, physical damage, delivery, and documentation. It is a useful checklist for teams that need "supply chain" to include every artifact and organization capable of changing silicon behavior, not only counterfeit-part detection at procurement time.
-> https://media.defense.gov/2026/Aug/25/2003986216/-1/-1/0/CTR_ASIC_BEST_PRACTICES_THREAT_CATALOG.PDF
BlackStorm Security Research
BlackStorm's public research index collects long-form, step-by-step vulnerability research and exploit-development material. The current catalog spans Windows, macOS and iOS, browsers, hypervisors, reversing, and adjacent internals. It is worth bookmarking as a reference hub rather than treating each article as an isolated link.
-> https://blackstormsecurity.com/research/
Anti-Surveillance Hardware from DEF CON
This field tour covers several low-cost counter-surveillance projects: an ESP32-based detector that passively identifies Flock camera infrastructure through Wi-Fi and Bluetooth characteristics, EFF's Rayhunter running on a second-hand mobile hotspot to detect cellular IMSI-catcher behavior, a wardriving device that warns when the same wireless infrastructure appears to follow the user, and Meshtastic hardware for user-controlled off-grid communication. The common theme is turning opaque surveillance infrastructure into something measurable with commodity radios and open tooling.
-> https://www.youtube.com/watch?v=-2uAsJ5EPAw
Until Next Time
Thanks for reading ZeroDayCommission #7. ZeroDayCommission is run by OrbitCurve. If you have feedback, research, tools, or talks worth sharing, email hussein@orbitcurve.com. I'll get back to you within three hours.
