EUVD-2026-126011

A security flaw has been discovered in D-Link DIR-850L FW1.20WWb03. This impacts an unknown function of the file /usr/sbin/consolepwd of the component Console Login. Performing a manipulation results in hard-coded credentials. The attack requires a local approach. The exploit has been released to...

CVE-2026-129445

A security flaw exists in the D-Link DIR-850L running firmware version FW1.20WWb03 . The vulnerability affects an unknown function within the Console Login component, specifically involving the file /usr/sbin/consolepwd . Exploiting this flaw allows an attacker to obtain hard-coded credentials vi...

CVE-2026-129352

A stack-based buffer overflow vulnerability exists in the TRENDnet TEW-657BRM firmware version 1.00.1 . The flaw is located in the unknown processing of the file /usr/sbin/upgrade_flash.cgi , where manipulating the argument boundary allows for remote execution. The vendor notes that the product h...

PT-2026-147438

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-657BRM version 1.00.1 Description A stack-based buffer overflow occurs during the processing of the /usr/sbin/upgrade flash.cgi endpoint. This issue is triggered by the manipulation of the argument boundary and can be exploited...

CVE-2026-129352: TRENDnet TEW-657BRM: A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1

A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgradeflash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit ...

CVE-2026-36698

Xovis AG APS-R-POE , APS-R-POE-PP , APS-R , APS-R-POE-USB , and APS-B (version 2.10.1.1 and earlier) are vulnerable to an OS command injection vulnerability (CWE-78) in the /sbin/ImportParamSet.sh script. The flaw exists because the script processes symlinks from uploaded parameter archive files ...

CVE-2026-36698

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

PT-2026-123355

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

Xovis APS-R security vulnerability

The Xovis APS-R has a security vulnerability. This vulnerability arises because the /sbin/ImportParamSet.sh script fails to reference or sanitize symbolic link targets when processing uploaded parameter archive files; instead, it embeds shell commands directly into these targets. These embedded...

PT-2026-96092

Name of the Vulnerable Software and Affected Versions ST Engineering iDirect Evolution versions prior to 20260717 Velocity WebServer Evolution versions prior to 20260717 Description A remote open redirect issue exists within the HTTP Header Handler component. The flaw is located in the authorize...

CVE-2026-94216: Improper Neutralization of CRLF Sequences in HTTP Headers

A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack...

FatPipe software multiple vulnerabilities

RISK EVALUATION FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon and a stack-based buffer overflow in /usr/sbin/authuserpass. An unauthenticated remote attacker with access to the...

CVE-2026-75783

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within...

CVE-2026-75783: Stack-based Buffer Overflow

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within...

CVE-2026-52199: Improper Neutralization of Special Elements used in a Command

An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component...

CVE-2026-15481

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoatest of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoaipaddr results in command injection. The attack is possible to ...

CVE-2026-15481 Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoatest of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoaipaddr results in command injection. The attack is possible to ...

CVE-2026-15481 Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoatest of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoaipaddr results in command injection. The attack is possible to ...

CVE-2026-15481

The CVE-2026-15481 affects Trendnet TEW-635BRM firmware up to 1.00.03, specifically the IPoA WAN Connection Setup component’s /sbin/rc function ipoa_test. A manipulation of the ipoa_ipaddr argument enables remote command injection, with network access as the attack vector and no user interaction ...

CVE-2026-15480 Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow

A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function starthttpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument devicename leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is...