Pwn2Own Toronto ! 63 Exploits $934,750 Bounty

At the latest Pwn2Own competition hosted by Trend Micro, participants discovered zero-day vulnerabilities in a range of products.

The three-day competition, totally paid out $934,750 to contestants. 26 contestants and teams attempted to exploit 66 target products.

This year represented the tenth anniversary of the consumer-focused edition of the competition and featured a new category focusing on Small Office Home Office (SOHO) equipment. To protect against the growing threat to systems used by home workers, which may represent an attractive route via which malicious actors can compromise corporate networks.

The team from DEVCORE claimed their second title with winnings of $142,500 and 18.5 points. Team Viettel and the NCC group were close behind with 16.5 and 15.5 points respectively.

Among the vendors whose products were hacked by contestants were HP, Mikrotik, Sonos, TP-Link, Ubiquiti, Western Digital, Lexmark, and Netgear. Devices targeted included printers, routers, smart speakers, NAS devices, and smartphones, such as the Samsung Galaxy S22.

The OEM of the products that are hacked, will now have 120 days to patch the 63 zero-days found in their offerings before they are publicly disclosed by the ZDI.