# mdns

Published articles for mdns.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices

DevFeed: [Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices](<https://devfeed.tech/articles/mongoose-preauth-rce-and-mtls-bypass-on-millions-of-devices-41273.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass/>)

Author: Simone Margaritelli

Published: 2026-04-01T22:00:00Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Mongoose](<https://devfeed.tech/topics/mongoose.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Internet of things](<https://devfeed.tech/topics/iot.md>), [C](<https://devfeed.tech/topics/c.md>), [cross-platform](<https://devfeed.tech/topics/cross-platform.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [MQTT](<https://devfeed.tech/topics/mqtt.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>)

Tags: [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [c](<https://devfeed.tech/tags/c.md>), [cesanta](<https://devfeed.tech/tags/cesanta.md>), [cross-platform](<https://devfeed.tech/tags/cross-platform.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-5244](<https://devfeed.tech/tags/cve-2026-5244.md>), [cve-2026-5245](<https://devfeed.tech/tags/cve-2026-5245.md>), [cve-2026-5246](<https://devfeed.tech/tags/cve-2026-5246.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded](<https://devfeed.tech/tags/embedded.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [heap-overflow](<https://devfeed.tech/tags/heap-overflow.md>), [http](<https://devfeed.tech/tags/http.md>), [https](<https://devfeed.tech/tags/https.md>), [industrial-control](<https://devfeed.tech/tags/industrial-control.md>), [iot](<https://devfeed.tech/tags/iot.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [library](<https://devfeed.tech/tags/library.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [mips](<https://devfeed.tech/tags/mips.md>), [mongoose](<https://devfeed.tech/tags/mongoose.md>), [mqtt](<https://devfeed.tech/tags/mqtt.md>), [mtls](<https://devfeed.tech/tags/mtls.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [stack-overflow](<https://devfeed.tech/tags/stack-overflow.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

The article reports three independently exploitable vulnerabilities in Mongoose v7.20, an embedded C networking library used in IoT devices: an mTLS authentication bypass, a preauthentication heap-overflow RCE through client public-key parsing, and a preauthentication RCE through mDNS over UDP. Mongoose v7.21 reportedly includes patches for the issues, which were assigned CVE-2026-5244, CVE-2026-5245, and CVE-2026-5246.

### Source excerpt

So, Mongoose. I

## Attacking UNIX Systems via CUPS, Part I

DevFeed: [Attacking UNIX Systems via CUPS, Part I](<https://devfeed.tech/articles/attacking-unix-systems-via-cups-part-i-41270.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/>)

Author: Simone Margaritelli

Published: 2024-09-26T14:51:30Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [gnu linux](<https://devfeed.tech/topics/gnu-linux.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [cups](<https://devfeed.tech/tags/cups.md>), [cups-browsed](<https://devfeed.tech/tags/cups-browsed.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2024-47076](<https://devfeed.tech/tags/cve-2024-47076.md>), [cve-2024-47175](<https://devfeed.tech/tags/cve-2024-47175.md>), [cve-2024-47176](<https://devfeed.tech/tags/cve-2024-47176.md>), [cve-2024-47177](<https://devfeed.tech/tags/cve-2024-47177.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [gnu-linux](<https://devfeed.tech/tags/gnu-linux.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [ipp](<https://devfeed.tech/tags/ipp.md>), [lan](<https://devfeed.tech/tags/lan.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [no-authentication](<https://devfeed.tech/tags/no-authentication.md>), [port](<https://devfeed.tech/tags/port.md>), [print-services](<https://devfeed.tech/tags/print-services.md>), [printer](<https://devfeed.tech/tags/printer.md>), [printers](<https://devfeed.tech/tags/printers.md>), [printing](<https://devfeed.tech/tags/printing.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [udp](<https://devfeed.tech/tags/udp.md>), [unauthenticated-access](<https://devfeed.tech/tags/unauthenticated-access.md>), [unix](<https://devfeed.tech/tags/unix.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>), [zeroconf](<https://devfeed.tech/tags/zeroconf.md>)

### AI overview

A security writeup describes multiple vulnerabilities in CUPS components affecting GNU/Linux and other UNIX systems. It reports that remote unauthenticated attackers may replace printer IPP URLs and trigger arbitrary command execution when a print job starts, with attacks possible over the public internet or via spoofed LAN advertisements.

### Source excerpt

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start

## Reverse Engineering the Apple MultiPeer Connectivity Framework

DevFeed: [Reverse Engineering the Apple MultiPeer Connectivity Framework](<https://devfeed.tech/articles/reverse-engineering-the-apple-multipeer-connectivity-framework-41267.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2022/10/20/Reverse-Engineering-the-Apple-MultiPeer-Connectivity-Framework/>)

Author: Simone Margaritelli

Published: 2022-10-20T11:05:13Z

Content type: tutorial

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Python](<https://devfeed.tech/topics/python.md>), [client](<https://devfeed.tech/topics/client.md>), [Network](<https://devfeed.tech/topics/network.md>), [Framework](<https://devfeed.tech/topics/framework.md>)

Tags: [apple](<https://devfeed.tech/tags/apple.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [facetime](<https://devfeed.tech/tags/facetime.md>), [framework](<https://devfeed.tech/tags/framework.md>), [ice](<https://devfeed.tech/tags/ice.md>), [ios](<https://devfeed.tech/tags/ios.md>), [iphone](<https://devfeed.tech/tags/iphone.md>), [logic-pro](<https://devfeed.tech/tags/logic-pro.md>), [mac](<https://devfeed.tech/tags/mac.md>), [macos-security](<https://devfeed.tech/tags/macos-security.md>), [mcpeer](<https://devfeed.tech/tags/mcpeer.md>), [mcpeerid](<https://devfeed.tech/tags/mcpeerid.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [mpc-framework](<https://devfeed.tech/tags/mpc-framework.md>), [multipeer](<https://devfeed.tech/tags/multipeer.md>), [multipeerconnectivity](<https://devfeed.tech/tags/multipeerconnectivity.md>), [network](<https://devfeed.tech/tags/network.md>), [network-packets](<https://devfeed.tech/tags/network-packets.md>), [network-protocol](<https://devfeed.tech/tags/network-protocol.md>), [ospf](<https://devfeed.tech/tags/ospf.md>), [proprietary-protocol](<https://devfeed.tech/tags/proprietary-protocol.md>), [protocol-reversing](<https://devfeed.tech/tags/protocol-reversing.md>), [python](<https://devfeed.tech/tags/python.md>), [re](<https://devfeed.tech/tags/re.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [stun](<https://devfeed.tech/tags/stun.md>), [tcp](<https://devfeed.tech/tags/tcp.md>), [undocumented](<https://devfeed.tech/tags/undocumented.md>), [wireshark](<https://devfeed.tech/tags/wireshark.md>)

### AI overview

A reverse-engineering investigation of Apple's undocumented Multipeer Connectivity Framework. The article examines its custom TCP protocol, documents network packets, and describes a Python proof-of-concept client that discovers servers, establishes connections, and exchanges application data. It also reports parser vulnerabilities and discusses session spoofing.

### Source excerpt

Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote and was quite happy with it. After the session, the hacker in me became curious about how the tools were communicating with each other, so I quickly started Wireshark while establishing a connection and saw something that tickled my curiosity even more: some of the data, such as the client and server names, were transmitted in cleartext on what it seemed a custom (and as typical of Apple, undocumented) TCP protocol ("stevie" being the hostname of my Mac): Using lsof confirmed that this was indeed the communication between the client phone and Logic listening on port 56076: Initially I tought this was just some Logic Pro specific protocol and very lazily started looking into it, without much success mostly due to lack of motivation given the very limited scope of the research. After a while I tweeted asking if anyone had ever seen anything like it. @isComputerOn pointed out that this looked a lot like a protocol that has been partially reversed and presented by Alban Diquet back in 2014. Unfortunately, however brilliant, this research covers the protocol at a very high level and doesn't really document the packets, their fields and how to establish a connection from anything but a client using the Apple framework. However, this helped me a lot in two ways: first it helped me realize this was not just Logic Pro specific, but that it was part of the Multipeer Connectivity Framework, and gave me a few hints about the general logic of the protocol itself. With renewed curiosity and motivation then I jumped into this rabbit hole and managed to reverse engineer all network packets. This allowed me to write a Python proof of concept client that automatically discovers any MPC servers, initializes the connection and succesfully exchanges application specific data packets. Moreover, while sending crafted packets and at