The Curious Engineer

All blogs / Security

nns.ee

blog.nns.ee

Ethical Hacking and Cybersecurity Blog

Security

’17’18’19’20’21’22’23’24’25’26
Posts
30 from 16 Jun 2017 to 24 Sep 2026
Posting
monthly (7 in the last year)
Kind
personal blog
Feed
https://blog.nns.ee/index.xml

2026 7

  1. Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL
  2. Chaining multiple vulnerabilities in Project Zomboid to execute code on a multiplayer client
  3. Bypassing the Sound Blaster's new firmware signature check
  4. Pwnd Blaster: Hacking your PC using your speaker without ever touching it
  5. Reverse engineering the Creative Katana V2X soundbar to be able to control it from Linux
  6. Solving Fossil SCM's CAPTCHA in 171 characters
  7. Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters

2025 3

  1. Bypassing dnsmasq dhcp-script limitations for command execution in config injection attacks
  2. Retrospective on hosting my blog inside an LTE modem, 4 years later
  3. When parameterization fails: SQL injection in Nim's db_postgres module using parameterized queries

2022 3

  1. Symlinks as mount portals: Abusing container mount points on MikroTik's RouterOS to gain code execution
  2. Code execution as root via AT commands on the Quectel RG500Q-EA 5G modem
  3. Don't trust comments

2021 3

  1. Code execution as root via AT commands on the Quectel EG25-G modem
  2. This blog is now hosted on a GPS/LTE modem
  3. Viewing and resetting the BIOS passwords on the RedmiBook 16

2020 1

  1. Patching ACPI tables to enable deep sleep on the RedmiBook 16

2019 3

  1. iopshell: A shell-like application for communicating with IOPSYS devices
  2. chroot shenanigans 2: Running a full desktop environment on an Amazon Kindle
  3. chroot shenanigans: Running Arch Linux on OpenWRT (LEDE) routers

2018 4

  1. Unsafe firewall includes allowing for remote code execution on Inteno's IOPSYS devices
  2. Creating a key generator to reset a Hikvision IP camera's admin password
  3. From writing to /tmp to a root shell on Inteno IOPSYS
  4. pwn910nd - abusing OpenWRT's printer server to become root

2017 6

  1. Remote Code Execution vulnerability in Inteno's Iopsys
  2. CVE-2017-11361 post-remedy: Is it fixed?
  3. Inteno misconfigured ACLs leading to information disclosure and logging in as root
  4. Installing custom OpenWRT on an Inteno (DG301) router
  5. ksoft's Easy Auto Refresh extension is selling your data
  6. Restoring stock BIOS on a Braswell Chromebook with a broken rom