Multiple RCE vulnerabilities affecting billions of devices. Allows remote code execution without user interaction.
Collection of vulnerabilities in BLE SoCs. Can cause DoS, deadlocks, and security bypass.
Key Negotiation of Bluetooth - forces weak encryption keys that can be brute-forced.
DoS and code execution vulnerabilities in Bluetooth Classic implementations.
Impersonate previously paired devices without re-authentication.
Force role switch to bypass security requirements.
Overwrite BLE LTK with weak BR/EDR link key via CTKD.
Replay captured cross-transport keys.
Spoof legitimate server during reconnection.
Write to signed characteristics without verification.
Remote code execution on Texas Instruments BLE chips.
Crash TI chips with malformed advertisements.
Act as HID keyboard to inject commands.
Control mouse to perform automated actions.
Create transparent proxy between device and app.
Replay and modify intercepted commands.
Downgrade pairing method through confusion.
Race condition in pairing process.
Flood L2CAP Connection-Oriented Channels.
Extract passkey through timing analysis.
Disrupt mesh networks with packet floods.
Exhaust flow control credits.
Exploit Apple's proprietary protocols for tracking and popup attacks.
Manipulate fitness data and extract personal information.
Test smart lock security and authentication bypass.
Common vulnerabilities in IoT implementations.
Dump all services, characteristics, and readable values from the target device.
Extract captured encryption keys, PINs, and other security credentials.
Write custom payloads to writable characteristics.
Fuzz device characteristics with malformed data.
Enhanced scan showing hidden networks and WPS status.
Force clients to disconnect using multiple reason codes.
Advanced phishing portal with credential harvesting.
Capture PMKID for offline password cracking.
Extract WPS nonces for offline PIN recovery.
Scan all common frequencies with multiple SF/BW combinations.
Replay with automatic counter incrementation and bit manipulation.
Selective jamming that detects and jams only legitimate packets.
Advanced fuzzing with edge cases and format string attacks.