Khaled Nassar notkmhn

## keybase-proof.md

      
              1 file
            
          
              0 forks
            
          
                0 comments
              
            
              0 stars
            
          
                notkmhn
                / keybase-proof.md
            
            
              Created
              July 13, 2022 21:18
            
          
    Keybase proof

I hereby claim:

I am notkmhn on github.
I am kmhn (https://keybase.io/kmhn) on keybase.
I have a public key ASCtx6IlSallQDIN8C8hqK8rqVEmSzKvTyE7ZO9BQwsCFAo

To claim this, I am signing this object:

  
## README.md

      
              2 files
            
          
              0 forks
            
          
                0 comments
              
            
              1 star
            
          
                notkmhn
                / README.md
            
            
              Last active
              August 16, 2026 14:20
            
              
                Realtek AmebaZ, AmebaZ2, AmebaZ2Plus buffer overflow handling oversized SSID IEs in 802.11 Beacon frame
              
          
    Description

This PoC exploits a bug in the Realtek AmebaZ, Z2 and Z2Plus SDKs for the RTL87xxxx SoC family. For example (non exhaustive):

RTL8710BN
RTL8710BX
RTL8720CF

The vulnerability is in the MLME code compiled into the SDK's static WLAN libraries, e.g. lib_wlan.a and lib_wlan_z2plus.a. Affected code path is reachable when both of these conditions are satisfied:

Target device is already associated to an AP as a STA. Most common deployment for IoT/smart devices using these SoCs.
Attacker spoofs a crafted 802.11 beacon frame as if it's sent by the AP that the device is associated to. Matching is done by comparing the sender's MAC to the AP's BSSID. Easy to do - beacon frames are unencrypted management frames.