Research, written down.

Language-model discoveries, vulnerability research, and the reverse engineering behind it: published as I find things, tagged so you can follow one vein at a time.

Start with a vein

Vulnerability Research

Bug reports, disclosures, and vulnerability write-ups, plus the reverse engineering behind them: decompilers, bytecode, and taking systems apart.

Browse vulnerability research → Language Models

Experiments, evaluations, and discoveries from working with language models.

Browse language models →

Latest

2026-10-08site-meta
Hello, stalactech

A new home for research notes, reverse engineering, and language-model experiments.
2020-10-02vulnerability-research
CVE-2020-12126: WAVLINK WN530H4 authentication bypass in /cgi-bin/

Multiple authentication bypass flaws in the /cgi-bin/ endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) let an unauthenticated attacker leak router settings, change configuration variables, and cause denial of service.
2020-10-02vulnerability-research
CVE-2020-12127: WAVLINK WN530H4 information disclosure in ExportAllSettings.sh

The /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) disclosed router settings, including cleartext login details and DNS settings, without authentication.
2020-10-02vulnerability-research
CVE-2020-12124: WAVLINK WN530H4 unauthenticated command injection in live_api.cgi

The /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) allowed an unauthenticated remote attacker to execute arbitrary Linux commands as root via command-line injection.
2020-10-02vulnerability-research
CVE-2020-12125: WAVLINK WN530H4 buffer overflow in makeRequest.cgi

The /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) had a remote buffer overflow that let an unauthenticated attacker execute arbitrary machine instructions as root.
2020-10-02vulnerability-research
CVE-2020-12123: WAVLINK WN530H4 CSRF in router endpoints

The /cgi-bin/ endpoints of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) lacked CSRF tokens, so an attacker could reach router functions through a user authenticated in the router portal.
2020-04-23vulnerability-research
CVE-2020-8797: Juplink RX4-1500 command-line injection

On the Juplink RX4-1500 running firmware v1.0.3, an attacker on the local network who can authenticate as admin could gain root access to the Linux subsystem through an unsanitized exec call when the undocumented telnetd service is enabled.
2020-04-23vulnerability-research
CVE-2020-8798: Juplink RX4-1500 unauthenticated setup endpoint

The httpd service in Juplink RX4-1500 firmware v1.0.3 through v1.0.5 exposed an unauthenticated setup3.htm endpoint that let a local-network attacker change or access router settings.