https://abhinavagarwal07.github.io/Abhinav AgarwalSecurity vulnerability research and advisories by Abhinav Agarwal. 2026-08-01T23:16:58+00:00 Abhinav Agarwal https://abhinavagarwal07.github.io/ Jekyll © 2026 Abhinav Agarwal /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png No Password, No Association, No Fix: Four Bugs in the Wi-Fi Daemon SteamOS Ships by Default2026-08-01T00:00:00+00:00 2026-08-01T23:16:00+00:00 https://abhinavagarwal07.github.io/posts/iwd-rrm-stack-overflow/ Abhinav Agarwal A nearby attacker can knock a Linux machine off Wi-Fi with one spoofed frame — no password, no association. iwd writes 31 bytes per visible access point into a 512-byte stack buffer and never checks; seventeen APs in range overflows it. SteamOS ships iwd as its default backend, where the impact is a crash rather than code execution. Reported in May, confirmed, patches sent. Still unfixed. Security Flaws in a Major OPC UA Library Used in Critical Infrastructure2026-07-30T00:00:00+00:00 2026-07-30T19:23:55+00:00 https://abhinavagarwal07.github.io/posts/open62541-pubsub-transfersubscriptions-cves/ Abhinav Agarwal Two memory-safety bugs I reported in open62541: an integer underflow in PubSub signature verification and a use-after-free in TransferSubscriptions. Fixed in v1.3.19, v1.4.18 and v1.5.6. A Captured Login and a Padding Oracle: Recovering OPC UA Passwords in Eclipse Milo, the Stack Behind Industrial IoT2026-07-28T00:00:00+00:00 2026-07-30T17:19:53+00:00 https://abhinavagarwal07.github.io/posts/eclipse-milo-opcua-six-cves/ Abhinav Agarwal A CVSS 4.0 9.1 padding oracle in Eclipse Milo — the open-source OPC UA stack embedded across industrial IoT — lets an on-path attacker recover a user's OPC UA password from a single captured token. It is the sharpest of six server-side flaws, alongside an unauthenticated remote crash and an RBAC bypass. Fixed in 1.1.5. Patched in Public, Disclosed 76 Days Later: Four Unauthenticated Flaws in libIEC618502026-07-23T00:00:00+00:00 2026-07-23T19:04:32+00:00 https://abhinavagarwal07.github.io/posts/libiec61850-mms-goose-cves/ Abhinav Agarwal Four unauthenticated flaws in libIEC61850, the IEC 61850 stack behind substation MMS and GOOSE — one chained to RCE in a lab, three reliable crashes. Their fixes remained on a public development branch for 76 days before the coordinated CISA advisory (ICSA-26-204-06). Fixed in v1.6.2. OpenSSL's ARM64 SM2 Path Leaks a Private-Key Timing Fingerprint2026-05-09T00:00:00+00:00 2026-05-10T07:34:35+00:00 https://abhinavagarwal07.github.io/posts/openssl-sm2-timing/ Abhinav Agarwal OpenSSL's optimized SM2 scalar multiplication has data-dependent branches on the private key. Direct measurement of the EC_POINT_mul call used by SM2 decrypt shows r = -0.9828 between runtime and zero-nibble count, with a slope of -389 ns per zero nibble. This leaks a stable aggregate private-key fingerprint (~3 bits) and the same non-constant-time branch pattern may expose richer traces to cache-based attacks. ARM64 and RISC-V only. SM2 is required for systems subject to Chinese commercial cryptography regulations.