isitspying maintainers @isitspying maintainer
Member since 2026-11-05 · reputation 0
Reports · 34
- Malicious verified Looks like a stock USB cable; enumerates as HID keyboard on command and hosts a Wi-Fi access point for remote control and exfiltration (by design, sold as a pentest tool)Hak5 / MG O.MG Cable · 4h ago
- Vulnerable verified Weak Bluetooth PIN and missing message filtering allowed injecting CAN frames (e.g. stop the engine) from a nearby phone; patched by BoschBosch Drivelog Connect OBD-II dongle · 4h ago
- Vulnerable verified Path traversal in /hedwig.cgi leaks account credentials (CVE-2024-0769); device is EOL and unpatchedD-Link DIR-859 · 4h ago
- Vulnerable verified Unauthenticated command injection in the locale API (CVE-2023-1389), exploited by botnets; fixed in firmware 1.1.4TP-Link Archer AX21 (AX1800) · 4h ago
- Vulnerable verified Buffer overflow via FriendlyName (CVE-2023-27217) allows code execution from the LAN or the cloud; unpatched, EOLBelkin Wemo Mini Smart Plug F7C063 · 4h ago
- Vulnerable verified Bluetooth pairing flaw allows a nearby attacker to gain root and stream the camera and microphone; incidents of hijacked units reported in 2024Ecovacs Deebot X2 Omni · 4h ago
- Suspicious verified Firmware contained a dormant Qihoo 360 service able to take photos, record audio and report location on receipt of encrypted SMS commands; vendor removed it in an updateXplora X4 · 4h ago
- Vulnerable verified Unencrypted backend lets unauthenticated users read location history and spoof calls to the watch; EU recall (first under GDPR-related grounds)Enox Safe-Kid-One · 4h ago
- Vulnerable verified Unauthenticated Bluetooth LE connection lets nearby devices control the toy and play audioHasbro Furby Connect · 4h ago
- Malicious verified Unauthenticated Bluetooth microphone: anyone within range can listen and speak through the toyGenesis Toys i-Que Intelligent Robot · 4h ago
- Malicious verified Voice recordings and account data exposed via an unsecured MongoDB; unauthenticated BLE lets anyone nearby play audio and recordSpiral Toys CloudPets · 4h ago
- Malicious verified Unauthenticated Bluetooth microphone and speaker: anyone in range can listen and talk through the doll; voice data sent to a third-party speech vendorGenesis Toys My Friend Cayla · 4h ago
- Vulnerable verified Shared cloud (AWS) credentials in the companion app exposed other users' recordings and personal data (Bitdefender, 2020)iBaby Monitor M6S · 4h ago
- Suspicious verified Uploaded event thumbnails to vendor cloud and allowed unencrypted stream access via the web portal despite 'local only' marketing; vendor acknowledged (Feb 2023)
- Vulnerable verified Default admin password, sequential cloud IDs and unsigned firmware updates over XMEye P2P (SEC Consult, 2018; ICS-CERT advisory)XMEye-based cameras and NVRs · 4h ago
- Vulnerable verified Unauthenticated RCE via the uhttpd management service (CVE-2021-4045) before firmware 1.1.16TP-Link Tapo C200 · 4h ago
- Vulnerable verified Web server exposes configuration including credentials without authentication (CVE-2021-40150) on older firmwareReolink E1 Zoom · 4h ago
- Vulnerable verified Hard-coded S3 credentials in firmware expose every customer's cloud-stored video (CVE-2018-5560)Guardzilla GZ501W · 4h ago
- Vulnerable verified Multiple Talos-reported CVEs (2018): code execution via crafted packets and firmware downgrade pathsYi Technology Yi Home Camera 27US · 4h ago
- Vulnerable verified Authentication bypass (CVE-2019-9564) and stack overflow RCE (CVE-2019-12266) allow remote access to the SD card and video; v1 unpatched (EOL)Wyze Cam v1 · 4h ago
- Vulnerable verified Identity authentication bypass during login (CVE-2021-33044 / CVE-2021-33045) in affected firmware
- Vulnerable verified Unauthenticated remote command injection (CVE-2021-36260, CVSS 9.8); exploited in the wild per CISA KEV
- Malicious verified Android.Triada.231 embedded in the Zygote process of the stock firmware; installs modules and shows adsLeagoo M9 · 4h ago
- Malicious verified Firmware shipped with Andr/Xgen2-CY malware that contacts a C2 server (BSI, 2019)Keecoo P11 · 4h ago
- Malicious verified Firmware shipped with Andr/Xgen2-CY malware that contacts a C2 server (BSI, 2019)M-Horse Pure 1 · 4h ago
- Malicious verified Firmware shipped with Andr/Xgen2-CY malware that contacts a C2 server and can install further software (BSI, 2019)Doogee BL7000 · 4h ago
- Malicious verified Update server compromise pushed a malicious 'update' app that installed further malware and sent SMS; vendor confirmed and fixedGigaset GS270 · 4h ago
- Malicious verified Adups FOTA agent transmitted SMS text, contacts and call logs to a remote server every 72 hours without disclosureBLU R1 HD · 4h ago
- Malicious verified Named in BADBOX research: firmware backdoor contacts C2 and joins a residential proxy / ad-fraud networkX12 Plus · 4h ago
- Malicious verified Named in BADBOX research: firmware backdoor contacts C2 and joins a residential proxy / ad-fraud networkQ9 · 4h ago
- Malicious verified Named in BADBOX research: firmware backdoor contacts C2 and joins a residential proxy / ad-fraud networkX88 Pro 10 · 4h ago
- Malicious verified Named in BADBOX research: firmware backdoor contacts C2 and joins a residential proxy / ad-fraud networkT95Max · 4h ago
- Malicious verified Named in BADBOX research: firmware backdoor contacts C2 and joins a residential proxy / ad-fraud networkT95Z Plus · 4h ago
- Malicious verified Firmware contains BADBOX malware; contacts C2 infrastructure on first boot and installs ad-fraud modulesT95 · 4h ago