# bug-hunting

Published articles for bug-hunting.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting

DevFeed: [Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting](<https://devfeed.tech/articles/don-t-let-abliteration-abliterate-your-bug-hunting-discovering-verdict-bias-in-uncensored-models-39717.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/does-abliteration-skew-your-bug-hunting/>)

Author: clearbluejar

Published: 2026-09-01T06:00:00Z

Content type: article

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [freebsd](<https://devfeed.tech/topics/freebsd.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [gemma4](<https://devfeed.tech/topics/gemma4.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [gemma](<https://devfeed.tech/topics/gemma.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [bug-hunting](<https://devfeed.tech/tags/bug-hunting.md>), [cve](<https://devfeed.tech/tags/cve.md>), [false-positives](<https://devfeed.tech/tags/false-positives.md>), [freebsd](<https://devfeed.tech/tags/freebsd.md>), [gemma](<https://devfeed.tech/tags/gemma.md>), [gemma-4](<https://devfeed.tech/tags/gemma-4.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [llms](<https://devfeed.tech/tags/llms.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

The article examines local abliterated open-weight models during vulnerability scanning of FreeBSD kernel source. Compared with base models of the same family and size, the modified models produced substantially more candidate and VALID findings, including false positives, while the most aggressive build did not surface the real CVE in a 28-file scan. The article describes this tendency as verdict bias: a greater willingness to return positive findings under uncertainty.

### Source excerpt

Abliterated models never refuse, which makes them tempting for bug hunting. But on the same kernel source, they graduate three to four times as many findings to VALID, including false positives the base correctly rejects, and across a 28-file scan of FreeBSD's sys/rpc the most aggressive build never surfaced the real CVE at all.

## PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749

DevFeed: [PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749](<https://devfeed.tech/articles/pwnagent-a-one-click-wan-side-rce-in-netgear-rax-routers-with-cve-2023-24749-39683.md>)

Original publisher: [Read original article](<https://mahaloz.re/2023/02/25/pwnagent-netgear.html>)

Published: 2023-02-25T00:00:00Z

Content type: article

Language: en

Sources: [mahaloz.re](<https://devfeed.tech/sources/mahaloz-re.md>)

Topics: [bug](<https://devfeed.tech/topics/bug.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Hacking](<https://devfeed.tech/topics/hacking.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Logging](<https://devfeed.tech/topics/logging.md>)

Tags: [bug-hunting](<https://devfeed.tech/tags/bug-hunting.md>), [cve](<https://devfeed.tech/tags/cve.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [pwn2own](<https://devfeed.tech/tags/pwn2own.md>), [rce](<https://devfeed.tech/tags/rce.md>), [routers](<https://devfeed.tech/tags/routers.md>)

### AI overview

A technical breakdown of CVE-2023-24749, a remotely accessible command-injection vulnerability in some Netgear RAX routers. The article explains how the bug can enable WAN-side remote code execution, potentially with root access, and discusses its discovery and firmware status.

### Source excerpt

A breakdown of a bug SEFCOM T0 and I exploited to achieve a WAN-side RCE in some Netgear RAX routers for pwn2own 2022. The bug is a remotely accessible command injection due to bad packet logging, cataloged as CVE-2023-24749.