# responsible disclosure

Published articles for responsible disclosure.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices

DevFeed: [Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices](<https://devfeed.tech/articles/mongoose-preauth-rce-and-mtls-bypass-on-millions-of-devices-41273.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass/>)

Author: Simone Margaritelli

Published: 2026-04-01T22:00:00Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Mongoose](<https://devfeed.tech/topics/mongoose.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Internet of things](<https://devfeed.tech/topics/iot.md>), [C](<https://devfeed.tech/topics/c.md>), [cross-platform](<https://devfeed.tech/topics/cross-platform.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [MQTT](<https://devfeed.tech/topics/mqtt.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>)

Tags: [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [c](<https://devfeed.tech/tags/c.md>), [cesanta](<https://devfeed.tech/tags/cesanta.md>), [cross-platform](<https://devfeed.tech/tags/cross-platform.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-5244](<https://devfeed.tech/tags/cve-2026-5244.md>), [cve-2026-5245](<https://devfeed.tech/tags/cve-2026-5245.md>), [cve-2026-5246](<https://devfeed.tech/tags/cve-2026-5246.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded](<https://devfeed.tech/tags/embedded.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [heap-overflow](<https://devfeed.tech/tags/heap-overflow.md>), [http](<https://devfeed.tech/tags/http.md>), [https](<https://devfeed.tech/tags/https.md>), [industrial-control](<https://devfeed.tech/tags/industrial-control.md>), [iot](<https://devfeed.tech/tags/iot.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [library](<https://devfeed.tech/tags/library.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [mips](<https://devfeed.tech/tags/mips.md>), [mongoose](<https://devfeed.tech/tags/mongoose.md>), [mqtt](<https://devfeed.tech/tags/mqtt.md>), [mtls](<https://devfeed.tech/tags/mtls.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [stack-overflow](<https://devfeed.tech/tags/stack-overflow.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

The article reports three independently exploitable vulnerabilities in Mongoose v7.20, an embedded C networking library used in IoT devices: an mTLS authentication bypass, a preauthentication heap-overflow RCE through client public-key parsing, and a preauthentication RCE through mDNS over UDP. Mongoose v7.21 reportedly includes patches for the issues, which were assigned CVE-2026-5244, CVE-2026-5245, and CVE-2026-5246.

### Source excerpt

So, Mongoose. I

## Attacking UNIX Systems via CUPS, Part I

DevFeed: [Attacking UNIX Systems via CUPS, Part I](<https://devfeed.tech/articles/attacking-unix-systems-via-cups-part-i-41270.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/>)

Author: Simone Margaritelli

Published: 2024-09-26T14:51:30Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [gnu linux](<https://devfeed.tech/topics/gnu-linux.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [cups](<https://devfeed.tech/tags/cups.md>), [cups-browsed](<https://devfeed.tech/tags/cups-browsed.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2024-47076](<https://devfeed.tech/tags/cve-2024-47076.md>), [cve-2024-47175](<https://devfeed.tech/tags/cve-2024-47175.md>), [cve-2024-47176](<https://devfeed.tech/tags/cve-2024-47176.md>), [cve-2024-47177](<https://devfeed.tech/tags/cve-2024-47177.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [gnu-linux](<https://devfeed.tech/tags/gnu-linux.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [ipp](<https://devfeed.tech/tags/ipp.md>), [lan](<https://devfeed.tech/tags/lan.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [no-authentication](<https://devfeed.tech/tags/no-authentication.md>), [port](<https://devfeed.tech/tags/port.md>), [print-services](<https://devfeed.tech/tags/print-services.md>), [printer](<https://devfeed.tech/tags/printer.md>), [printers](<https://devfeed.tech/tags/printers.md>), [printing](<https://devfeed.tech/tags/printing.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [udp](<https://devfeed.tech/tags/udp.md>), [unauthenticated-access](<https://devfeed.tech/tags/unauthenticated-access.md>), [unix](<https://devfeed.tech/tags/unix.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>), [zeroconf](<https://devfeed.tech/tags/zeroconf.md>)

### AI overview

A security writeup describes multiple vulnerabilities in CUPS components affecting GNU/Linux and other UNIX systems. It reports that remote unauthenticated attackers may replace printer IPP URLs and trigger arbitrary command execution when a print job starts, with attacks possible over the public internet or via spoofed LAN advertisements.

### Source excerpt

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start

## Hacking a Herb Vaporizer to Set Its Temperature Limit From 190C to 6553.5C Remotely

DevFeed: [Hacking a Herb Vaporizer to Set Its Temperature Limit From 190C to 6553.5C Remotely](<https://devfeed.tech/articles/hacking-a-herb-vaporizer-to-set-its-temperature-limit-from-190c-to-6553-5c-remotely-41254.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2017/08/25/Mini-Post-Hacking-a-Herb-Vaporizer-using-GNU-Linux-and-BLE-raw-commands/>)

Author: Simone Margaritelli

Published: 2017-08-25T01:10:53Z

Content type: opinion

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Hacking](<https://devfeed.tech/topics/hacking.md>), [Bluetooth](<https://devfeed.tech/topics/bluetooth.md>), [Security](<https://devfeed.tech/topics/security.md>), [Hardware](<https://devfeed.tech/topics/hardware.md>)

Tags: [ble](<https://devfeed.tech/tags/ble.md>), [bluetooth](<https://devfeed.tech/tags/bluetooth.md>), [bluetooth-low-energy](<https://devfeed.tech/tags/bluetooth-low-energy.md>), [btle](<https://devfeed.tech/tags/btle.md>), [crafty](<https://devfeed.tech/tags/crafty.md>), [crafty-vaporizer](<https://devfeed.tech/tags/crafty-vaporizer.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [linux](<https://devfeed.tech/tags/linux.md>), [low-energy](<https://devfeed.tech/tags/low-energy.md>), [no-authentication](<https://devfeed.tech/tags/no-authentication.md>), [protocol-reversing](<https://devfeed.tech/tags/protocol-reversing.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [terminal](<https://devfeed.tech/tags/terminal.md>), [vaporizer](<https://devfeed.tech/tags/vaporizer.md>)

### AI overview

The article describes reverse engineering the Crafty vaporizer's mobile application and Bluetooth Low Energy interface. It reports that device descriptors could be read and written without authentication and that the temperature value was stored as two bytes, allowing a remote attempt to change the limit from 190°C to 6553.5°C. The author did not test the modified setting.

### Source excerpt

Tonight my brain decided, instead of sleeping (why even bother trying, right?), to start a new short adventure in the Bluetooth Low Energy world. I'm a happy Crafty vaporizer owner and as I discovered by chance, I can access it using my laptop.