Thursday, April 3, 2025
HomeBug BountyPwn2Own - Hackers earn $400K for 26 zero-day Exploits

Pwn2Own – Hackers earn $400K for 26 zero-day Exploits

Published on

SIEM as a Service

Follow Us on Google News

There has been a lot of excitement surrounding Pwn2Own Miami for 2022 and it was an incredible three-day competition. Over $400,000 has been awarded for 26 unique 0-days and bug collisions.

During the contest between April 19 and April 21, the competitors targeted the ICS and SCADA products. Further, it is worth noting that many other product categories were also targeted by the cyber security researchers, and here they are:-

  • Control Server
  • OPC Unified Architecture Server
  • Data Gateway
  • Human Machine Interface (HMI)

All the security flaws that are exploited during the Pwn2Own competition have been reported to the respective vendors. ZDI requires all vendors to release patches within 120 days after ZDI publicly discloses them to the industry.

Master of Pwn

Computest Sector 7 (@sector7_nl) has been crowned Master of Pwn for the second time with the combined scores of 90 points over three days accumulated by the duo of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps).

Listed below are all the entries with full results and the total points for each entry:-

Winners are Rewarded $90,000

After exploring the Inductive Automation Ignition SCADA control server solution using a missing authentication vulnerability used by the master of the Pwn team (Computest Sector 7), they collected $20,000 on day one.

Computest Sector 7 exploited an uncontrolled search path vulnerability in the AVEVA Edge HMI/SCADA software in order to gain RCE, for which they were awarded once again with the amount of $20,000 on the same day.

In the second round of the competition, the Computest Sector 7 exploited an endless loop condition to trigger a Denial of Service state against the Unified Automation C++ Demo Server and made $5,000.

Pwn2Own Miami 2022 saw the class of Computest Sector 7, and make their way through day two without a hitch, bypassing the trusted application check on the native OPC Foundation OPC UA .NET Standard and earned a hefty reward of $40,000.

Here’s what ZDI stated:-

“one of the more interesting bugs we’ve ever seen at a Pwn2Own.”

In the first edition of Pwn2Own Miami, the ICS-themed contest that is held back in January 2020, they awarded $280,000 for 24 unique zero-day flaws in critical infrastructure and SCADA products.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

SonicWall Firewall Vulnerability Enables Unauthorized Access

Researchers from Bishop Fox have successfully exploited CVE-2024-53704, an authentication bypass vulnerability that affects SonicWall...

Russian Seashell Blizzard Targets Organizations Using Custom-Built Hacking Tools

Seashell Blizzard, also known as APT44, Sandworm, and Voodoo Bear, has emerged as a...

EvilCorp and RansomHub Collaborate to Launch Worldwide Attacks on Organizations

EvilCorp, a sanctioned Russia-based cybercriminal enterprise, has been observed collaborating with RansomHub, one of...

AI-Powered Gray Bots Target Web Applications with Over 17,000 Requests Per Hour

Web applications are facing a growing challenge from "gray bots," a category of automated...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

SonicWall Firewall Vulnerability Enables Unauthorized Access

Researchers from Bishop Fox have successfully exploited CVE-2024-53704, an authentication bypass vulnerability that affects SonicWall...

Russian Seashell Blizzard Targets Organizations Using Custom-Built Hacking Tools

Seashell Blizzard, also known as APT44, Sandworm, and Voodoo Bear, has emerged as a...

EvilCorp and RansomHub Collaborate to Launch Worldwide Attacks on Organizations

EvilCorp, a sanctioned Russia-based cybercriminal enterprise, has been observed collaborating with RansomHub, one of...