# vulnerability-research

Published articles for vulnerability-research.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting

DevFeed: [Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting](<https://devfeed.tech/articles/don-t-let-abliteration-abliterate-your-bug-hunting-discovering-verdict-bias-in-uncensored-models-39717.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/does-abliteration-skew-your-bug-hunting/>)

Author: clearbluejar

Published: 2026-09-01T06:00:00Z

Content type: article

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [freebsd](<https://devfeed.tech/topics/freebsd.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [gemma4](<https://devfeed.tech/topics/gemma4.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [gemma](<https://devfeed.tech/topics/gemma.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [bug-hunting](<https://devfeed.tech/tags/bug-hunting.md>), [cve](<https://devfeed.tech/tags/cve.md>), [false-positives](<https://devfeed.tech/tags/false-positives.md>), [freebsd](<https://devfeed.tech/tags/freebsd.md>), [gemma](<https://devfeed.tech/tags/gemma.md>), [gemma-4](<https://devfeed.tech/tags/gemma-4.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [llms](<https://devfeed.tech/tags/llms.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

The article examines local abliterated open-weight models during vulnerability scanning of FreeBSD kernel source. Compared with base models of the same family and size, the modified models produced substantially more candidate and VALID findings, including false positives, while the most aggressive build did not surface the real CVE in a 28-file scan. The article describes this tendency as verdict bias: a greater willingness to return positive findings under uncertainty.

### Source excerpt

Abliterated models never refuse, which makes them tempting for bug hunting. But on the same kernel source, they graduate three to four times as many findings to VALID, including false positives the base correctly rejects, and across a 28-file scan of FreeBSD's sys/rpc the most aggressive build never surfaced the real CVE at all.

## System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models

DevFeed: [System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models](<https://devfeed.tech/articles/system-over-model-tested-reproducing-mythos-s-freebsd-find-on-local-open-weight-models-39721.md>)

Original publisher: [Read original article](<https://clearbluejar.github.io/posts/system-over-model-tested-mythos-freebsd-local-openweight/>)

Author: clearbluejar

Published: 2026-06-04T07:00:00Z

Content type: article

Language: en

Sources: [clearbluejar](<https://devfeed.tech/sources/clearbluejar.md>)

Topics: [freebsd](<https://devfeed.tech/topics/freebsd.md>), [gpt-oss](<https://devfeed.tech/topics/gpt-oss.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [gemma4](<https://devfeed.tech/topics/gemma4.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Benchmark](<https://devfeed.tech/topics/benchmark.md>), [Python](<https://devfeed.tech/topics/python.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [benchmark](<https://devfeed.tech/tags/benchmark.md>), [cve](<https://devfeed.tech/tags/cve.md>), [false-positives](<https://devfeed.tech/tags/false-positives.md>), [freebsd](<https://devfeed.tech/tags/freebsd.md>), [gemma-4](<https://devfeed.tech/tags/gemma-4.md>), [gpt-oss](<https://devfeed.tech/tags/gpt-oss.md>), [llm](<https://devfeed.tech/tags/llm.md>), [llms](<https://devfeed.tech/tags/llms.md>), [python](<https://devfeed.tech/tags/python.md>), [rce](<https://devfeed.tech/tags/rce.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

This article tests AISLE's vulnerability-finding pipeline on the local open-weight models gpt-oss-20b and gemma-4-31b-it using a FreeBSD RCE as the benchmark. The models initially appeared to miss the bug, but a rerun recovered it. The author reports that adding a reachability stage reduced false positives from 30 to 5 while retaining the CVE finding.

### Source excerpt

Mythos found a 17-year-old FreeBSD RCE; AISLE reproduced it with gpt-5.4-nano via their nano-analyzer pipeline. I ran the pipeline on two local open-weight models, gpt-oss-20b and gemma-4-31b-it. The misses recovered on re-run. The real problem was the false-positive rate, and one extra system stage cut it from 30 to 5 with the CVE still standing.

## Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices

DevFeed: [Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices](<https://devfeed.tech/articles/mongoose-preauth-rce-and-mtls-bypass-on-millions-of-devices-41273.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass/>)

Author: Simone Margaritelli

Published: 2026-04-01T22:00:00Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Mongoose](<https://devfeed.tech/topics/mongoose.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Internet of things](<https://devfeed.tech/topics/iot.md>), [C](<https://devfeed.tech/topics/c.md>), [cross-platform](<https://devfeed.tech/topics/cross-platform.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [MQTT](<https://devfeed.tech/topics/mqtt.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>)

Tags: [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [c](<https://devfeed.tech/tags/c.md>), [cesanta](<https://devfeed.tech/tags/cesanta.md>), [cross-platform](<https://devfeed.tech/tags/cross-platform.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-5244](<https://devfeed.tech/tags/cve-2026-5244.md>), [cve-2026-5245](<https://devfeed.tech/tags/cve-2026-5245.md>), [cve-2026-5246](<https://devfeed.tech/tags/cve-2026-5246.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded](<https://devfeed.tech/tags/embedded.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [heap-overflow](<https://devfeed.tech/tags/heap-overflow.md>), [http](<https://devfeed.tech/tags/http.md>), [https](<https://devfeed.tech/tags/https.md>), [industrial-control](<https://devfeed.tech/tags/industrial-control.md>), [iot](<https://devfeed.tech/tags/iot.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [library](<https://devfeed.tech/tags/library.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [mips](<https://devfeed.tech/tags/mips.md>), [mongoose](<https://devfeed.tech/tags/mongoose.md>), [mqtt](<https://devfeed.tech/tags/mqtt.md>), [mtls](<https://devfeed.tech/tags/mtls.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [stack-overflow](<https://devfeed.tech/tags/stack-overflow.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

The article reports three independently exploitable vulnerabilities in Mongoose v7.20, an embedded C networking library used in IoT devices: an mTLS authentication bypass, a preauthentication heap-overflow RCE through client public-key parsing, and a preauthentication RCE through mDNS over UDP. Mongoose v7.21 reportedly includes patches for the issues, which were assigned CVE-2026-5244, CVE-2026-5245, and CVE-2026-5246.

### Source excerpt

So, Mongoose. I

## TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering

DevFeed: [TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering](<https://devfeed.tech/articles/tp-link-tapo-c200-hardcoded-keys-buffer-overflows-and-privacy-in-the-era-of-ai-assisted-reverse-engineering-41272.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2025/12/18/TP-Link-Tapo-C200-Hardcoded-Keys-Buffer-Overflows-and-Privacy-in-the-Era-of-AI-Assisted-Reverse-Engineering/>)

Author: Simone Margaritelli

Published: 2025-12-17T23:00:00Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Android](<https://devfeed.tech/topics/android.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-assisted-reverse-engineering](<https://devfeed.tech/tags/ai-assisted-reverse-engineering.md>), [android](<https://devfeed.tech/tags/android.md>), [assembly](<https://devfeed.tech/tags/assembly.md>), [aws](<https://devfeed.tech/tags/aws.md>), [china](<https://devfeed.tech/tags/china.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2025-14299](<https://devfeed.tech/tags/cve-2025-14299.md>), [cve-2025-14300](<https://devfeed.tech/tags/cve-2025-14300.md>), [cve-2025-8065](<https://devfeed.tech/tags/cve-2025-8065.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [ghidramcp](<https://devfeed.tech/tags/ghidramcp.md>), [hardcoded-credentials](<https://devfeed.tech/tags/hardcoded-credentials.md>), [integer-overflow](<https://devfeed.tech/tags/integer-overflow.md>), [iot](<https://devfeed.tech/tags/iot.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [memory](<https://devfeed.tech/tags/memory.md>), [mips](<https://devfeed.tech/tags/mips.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [re](<https://devfeed.tech/tags/re.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [reversing](<https://devfeed.tech/tags/reversing.md>), [security](<https://devfeed.tech/tags/security.md>), [security-research](<https://devfeed.tech/tags/security-research.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [tapo-c200](<https://devfeed.tech/tags/tapo-c200.md>), [tapo-camera](<https://devfeed.tech/tags/tapo-camera.md>), [tp-link](<https://devfeed.tech/tags/tp-link.md>), [tplink](<https://devfeed.tech/tags/tplink.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

This article describes an AI-assisted reverse-engineering investigation of TP-Link Tapo C200 camera firmware. The author reports finding several security vulnerabilities affecting about 25,000 devices directly exposed on the internet, and discusses the tools and process used.

### Source excerpt

Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always giv

## Attacking UNIX Systems via CUPS, Part I

DevFeed: [Attacking UNIX Systems via CUPS, Part I](<https://devfeed.tech/articles/attacking-unix-systems-via-cups-part-i-41270.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/>)

Author: Simone Margaritelli

Published: 2024-09-26T14:51:30Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [gnu linux](<https://devfeed.tech/topics/gnu-linux.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [cups](<https://devfeed.tech/tags/cups.md>), [cups-browsed](<https://devfeed.tech/tags/cups-browsed.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2024-47076](<https://devfeed.tech/tags/cve-2024-47076.md>), [cve-2024-47175](<https://devfeed.tech/tags/cve-2024-47175.md>), [cve-2024-47176](<https://devfeed.tech/tags/cve-2024-47176.md>), [cve-2024-47177](<https://devfeed.tech/tags/cve-2024-47177.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [gnu-linux](<https://devfeed.tech/tags/gnu-linux.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [ipp](<https://devfeed.tech/tags/ipp.md>), [lan](<https://devfeed.tech/tags/lan.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [no-authentication](<https://devfeed.tech/tags/no-authentication.md>), [port](<https://devfeed.tech/tags/port.md>), [print-services](<https://devfeed.tech/tags/print-services.md>), [printer](<https://devfeed.tech/tags/printer.md>), [printers](<https://devfeed.tech/tags/printers.md>), [printing](<https://devfeed.tech/tags/printing.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [udp](<https://devfeed.tech/tags/udp.md>), [unauthenticated-access](<https://devfeed.tech/tags/unauthenticated-access.md>), [unix](<https://devfeed.tech/tags/unix.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>), [zeroconf](<https://devfeed.tech/tags/zeroconf.md>)

### AI overview

A security writeup describes multiple vulnerabilities in CUPS components affecting GNU/Linux and other UNIX systems. It reports that remote unauthenticated attackers may replace printer IPP URLs and trigger arbitrary command execution when a print job starts, with attacks possible over the public internet or via spoofed LAN advertisements.

### Source excerpt

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start