Hackers Earn $350k in Second Day of Pwn2Own Toronto 2019

Hackers have earned roughly $350,000 in rewards after demonstrating successful exploits against a variety of devices on the second day of the Zero Day Initiative’s Pwn2Own Toronto 2023 competition.

On Wednesday, NAS devices were hacked, as well as printers, smart speakers and mobile phones. Successful exploits were also demonstrated against routers.

ZDI announced the highest award went to Chris Anastasio. He earned $100,000 for exploits that targeted a vulnerability in P-Link Omada Gigabit and one in Lexmark CX331adwe.

On the second competition day, a Devcore internship earned $50,000 for a stack-buffer overflow issue with the TP Link Omada Gigabit NAS and two flaws with the QNAP TS-464 NAS.

On Wednesday, Team Orca from Sea Security earned $50,000 for a bug found in the Synology RT6600ax Router and a three-bug string against the QNAP TS-464 NAS Device.

Rewards of $30,000 have been given out for a command inject in the Wyze cam v3 security cameras and an issue with the Sonos Era100 smart speaker.

ZDI has also announced high-rewards for an improper input validity bug and a permissive input list flaw in Samsung Galaxy S23 (25 000 dollars), a stack based buffer overflow in the HP Color LaserJet Pro MFP 42301fdw (20 000 dollars), and a vulnerability based on a buffer stack in the Canon imageCLASS M753Cdw printer (10 000 dollars).

Also, multiple low-tier reward were given out for exploits targeting vulnerabilities in QNAP’s TS-464 and Wyze Cam v3, Synology BC500 and Canon imageCLASS BC753Cdw.

ZDI reports that hackers participating in the competition have earned more than $800,000 in rewards over the first two days. The competition is scheduled to end on Friday.

Related: Hackers Earn $400k in First Day of Pwn2Own Toronto 2019

Related: New Pwn2Own Auto Hacking Contest: Over $1 Million in Prizes

Related: Hackers Earn $180,000 from ICS Exploits during Pwn2Own Miami 2019