Espilon Learn
Hardware security training on real IoT, OT and embedded devices. Courses, challenges, labs and device emulation.
What we find
A few of our published findings. The full list lives on the advisories page.
CVE-2026-45328
Out-of-bounds write in the ESP-TEE secure service wrappers: a write primitive inside the part of the chip that's supposed to be trusted.
FreeRTOS-Plus-TCP & coreMQTT
Five CVEs in the network stack that ships on millions of devices: an RA out-of-bounds write, a DHCPv6 integer underflow, an MQTT v5 DoS and more.
CVE-2026-47773
Memory corruption in ArduinoBLE via a malformed ATT write request. Send the wrong bytes over Bluetooth, corrupt the parser's memory.
The framework
One ESP32 firmware. Every capability is a signed module you push at runtime.
The device ships with a loader, a crypto core and a transport. Everything else arrives as a signed module, a sensor driver, a mesh node, a recon tool, loaded into IRAM at runtime, encrypted in, wiped on unload. Same engine, any job.
SimSift
Portable SIM card forensic tool on ESP32. Compatible with LilyGo T-Call and T-SIM7070G.
GitHub →
Espilon Monitor
Universal serial monitor for embedded devices. Watch multiple ports, detect crashes and events by regex pattern, fire Python hooks, stream structured JSON to your pipeline.
sudo apt install emon
brew install EspilonOrg/tap/emon
yay -S emon
Everything we ship
Framework, CTF, docs, blog and tools. All open, all linked below.
Come hang out
Write-ups, challenge support, hardware finds and IoT/OT talk. New challenges drop regularly.