Published CVEs
Every entry links to its GHSA advisory. Reported by Eun0us.
Two more in coordinated disclosure right now.
What we dig into
The four tracks most of our findings come from.
Embedded network stacks
Where most of our CVEs live: FreeRTOS-Plus-TCP and lwIP. DHCP/DHCPv6 option parsers, IPv6 Router Advertisement processing, MAC-address validation. The code that chews on untrusted packets across millions of devices.
Bluetooth & BLE
Heap overflows and out-of-bounds reads through the BLE stack: ESP-IDF protocomm Security2, Bluedroid's AVRCP parser, and the ArduinoBLE ATT layer.
ESP32 secure services (ESP-TEE)
The trusted side of the chip. Out-of-bounds reads and writes in the ESP-TEE secure service wrappers, including a 9.3 critical.
Wireless & messaging protocols
Protocol parsers that turn a malformed frame into memory corruption or a denial of service: Espressif's ESP-NOW and the MQTT v5 path in coreMQTT.
Write-ups & publications
How we found the bugs, and how the CTF challenges were meant to fall.
Espilon CTF write-ups
Full solutions for the 2026 edition: hardware, IoT, OT, ESP32 and networks.
Espilon Source : un framework d'agent ESP32 pour la recherche en securite IoT
Architecture overview, threat model, and design decisions behind the modular ESP32 framework.
Tools & resources
Open-source projects that come out of the research.
Espilon Framework
Modular ESP32 platform: signed runtime modules, ChaCha20-Poly1305 C2, anti-forensic IRAM wipe. Three repos releasing Jun 13.
Espilon Monitor
Universal serial monitor for embedded devices. Multi-port, pattern detection, automatic reactions. v0.1.0, out now.
SimSift
Portable SIM card forensic tool on ESP32: read identity, scan networks, detect downgrade attacks and suspicious re-routes.
Eye_On_xG
Cellular antenna coverage across France, 2G to 5G, on official ANFR open data.