Research,
across the threat landscape.
Explore OPSWAT Unit 515’s offensive security research, covering vulnerability discoveries, CVE analyses, exploitation techniques, and real-world attack investigations.
2026
Oct 16October
Chaining a replayed login into full control of a home camera
Three flaws in a popular home camera combine into one path: replay a login, take an admin session, then inject commands into a diagnostic service. Here is how the chain works and how to shut it down.OS command executionCVE-2026-102369CVE-2026-15315CVE-2026-15316Mar 25March
From a lobby account to a switch that will not boot: four Catalyst 9300 CVEs
A low-privilege web account on an enterprise access switch can climb one privilege level and then push the device into maintenance mode, where it may need someone on site to recover it.thanhlocpandaOPSWAT Unit 5151 min readPersistent DoSCVE-2026-20110Feb 26February
Testing public exploit claims for an SSO authentication bypass
Public proofs of concept for a widely reported SSO bypass did not work, so we rebuilt the conditions in the lab to find out what an attacker really needs.Authentication bypass
2025
Jul 29July
How an incomplete patch left a dashboard account takeover open
An earlier fix closed one open redirect, but a second redirect and a client-side path traversal rebuilt the same account takeover chain.Account takeoverCVE-2025-6023CVE-2025-6197May 29May
Reading internal files from a PLC's embedded web server
Crafted requests to the web server of a widely deployed PLC return files that should never leave the controller, without any authentication.thanhlocpandaOPSWAT Unit 5151 min readUnauthenticated file accessCVE-2025-2875Jan 20January
When an AI agent trusts the tool description more than the user
Agents read tool descriptions as instructions. We show how a poisoned description in a shared tool server steers an agent, and how to review tools before you connect them.Instruction injection
2024
First Unit 515 publication · May 2024