Every finding confirmed with AddressSanitizer (20+ test runs each) and independently validated by three commercial LLMs before reporting to vendors.
| MITRE # | Domain | Vulnerability | CVSS |
|---|---|---|---|
| #2014701 | Frontend Framework SSR | SSTI → Remote Code Execution | 10.0 |
| #2014716 | Automotive OS | Widget Zip Slip → RCE | 9.8 |
| #2014740 | CAN TCP Gateway | Stack Buffer Overflow | 9.8 |
| #2014747 | CAN-over-Ethernet | Heap Overflow (UDP/TCP/SCTP) | 9.8 |
| #2014750 | Vehicle Monitoring | GVRET Frame Triple Overflow | 9.8 |
| #2013193 | Automotive OS Core | Unauthenticated Privilege Escalation | 7.8 |
| #2014714 | Automotive CAN Service | UDS Stack Buffer Overflow | 7.8 |
| #2014719 | Automotive CAN Protocol | ISO-TP Out-of-Bounds Read | 7.1 |
| #2014728 | Heavy Vehicle Protocol | Integer Underflow → OOB Write | 8.2 |
| #2014734 | CAN Protocol Library | ISO-TP Nibble OOB Read | 7.1 |
| #2014736 | Heavy Vehicle Protocol (fork) | TP Integer Underflow | 8.2 |
| #2014758 | Embedded IPC Framework | ELF Loader Integer Overflow | 8.1 |
| #2013988 | Frontend Framework SSR | Event Handler Filter Bypass → XSS | 7.2 |
All findings under coordinated disclosure. CVE IDs will be published after vendor patches are released.
Three commercial LLMs independently analyze source code for vulnerability patterns. Consensus ≥ 2/3 required to proceed.
20+ AddressSanitizer test runs per finding with varied parameters. 100% crash rate on overflow inputs, 100% clean on normal inputs.
Each finding independently confirmed by Gemini, GLM-5, and Kimi-K2. Only 3/3 unanimous confirmations are reported to vendors.
Follow the evidence chain from the public research timeline to the full methodology, Trust Center, and productized scanner proof.
AI-assisted audit method
Explains target selection, three-model validation, dynamic verification, false-positive handling, and disclosure boundaries.
Claims tied to sources
Connects the research record to security.txt, public engineering surface, and buyer-verifiable evidence paths.
CVE benchmark proof
Shows how the vulnerability-research workflow maps into the Nora Scan product surface and proof module.
Our team uses this exact methodology for client engagements.