Another favorite, https://www.synacktiv.com/publications/cool-vulns-dont-live-long-netgear-and-pwn2own https://www.synacktiv.com/publications/cool-vulns-dont-li

Another favorite, https://www.synacktiv.com/publications/cool-vulns-dont-live-long-netgear-and-pwn2own https://www.synacktiv.com/publications/cool-vulns-dont-live-... the router sniffed plaintext http to grab HTTP User agents to put them into a curl bash command line string. Nice RCE from the browser.