Monday, May 12, 2025
HomeBug BountyPwn2Own - Hackers earn $400K for 26 zero-day Exploits

Pwn2Own – Hackers earn $400K for 26 zero-day Exploits

Published on

SIEM as a Service

Follow Us on Google News

There has been a lot of excitement surrounding Pwn2Own Miami for 2022 and it was an incredible three-day competition. Over $400,000 has been awarded for 26 unique 0-days and bug collisions.

During the contest between April 19 and April 21, the competitors targeted the ICS and SCADA products. Further, it is worth noting that many other product categories were also targeted by the cyber security researchers, and here they are:-

  • Control Server
  • OPC Unified Architecture Server
  • Data Gateway
  • Human Machine Interface (HMI)

All the security flaws that are exploited during the Pwn2Own competition have been reported to the respective vendors. ZDI requires all vendors to release patches within 120 days after ZDI publicly discloses them to the industry.

- Advertisement - Google News

Master of Pwn

Computest Sector 7 (@sector7_nl) has been crowned Master of Pwn for the second time with the combined scores of 90 points over three days accumulated by the duo of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps).

Listed below are all the entries with full results and the total points for each entry:-

Winners are Rewarded $90,000

After exploring the Inductive Automation Ignition SCADA control server solution using a missing authentication vulnerability used by the master of the Pwn team (Computest Sector 7), they collected $20,000 on day one.

Computest Sector 7 exploited an uncontrolled search path vulnerability in the AVEVA Edge HMI/SCADA software in order to gain RCE, for which they were awarded once again with the amount of $20,000 on the same day.

In the second round of the competition, the Computest Sector 7 exploited an endless loop condition to trigger a Denial of Service state against the Unified Automation C++ Demo Server and made $5,000.

Pwn2Own Miami 2022 saw the class of Computest Sector 7, and make their way through day two without a hitch, bypassing the trusted application check on the native OPC Foundation OPC UA .NET Standard and earned a hefty reward of $40,000.

Here’s what ZDI stated:-

“one of the more interesting bugs we’ve ever seen at a Pwn2Own.”

In the first edition of Pwn2Own Miami, the ICS-themed contest that is held back in January 2020, they awarded $280,000 for 24 unique zero-day flaws in critical infrastructure and SCADA products.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...