copyfail-deconstructed

copyfail-deconstructed Easy-to-understand version of CVE-2026-31431, a privilege escalation technique that allows anybody to become root. The original proof-of-concept is found here: https://github.com/theori-io/copy-fail-CVE-2026-31431, but is heavily compressed and minified so it can have as...

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

Linux-CopyFail-C-Version-CVE-2026-31431

Linux CopyFail- C Version - CVE-2026-31431 Clean C version of Copy Fail CVE-2026-31431 - Linux Local Privilege Escalation exploit using AFALG + authencesn + splice primitive. Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges. Educational proof-of-concep...

CVE-2026-126720

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...

CVE-2026-126720 CVE-2026-126720

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...

EUVD-2026-123581

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...

CVE-2026-126720

The Rooxis RXR-12 Wi-Fi router is vulnerable to unauthenticated remote code execution due to an input validation flaw in /usr/bin/cloud_manage . An attacker positioned on-path with access to the hard-coded cloud endpoint can exploit the unsanitized diagnoseParameter field passed to popen() via cl...

PT-2026-145281

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is position...

CVE-2026-126722: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon…

Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon /usr/bin/telnetdstartup that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware...

CVE-2026-126720: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage,…

Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...

CVE-2026-123014

iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input...

CVE-2026-122013

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attac...

CVE-2026-122013

A path traversal vulnerability exists in the Multipart Parser component of Comfast CF-WR632AX version 2.6.0.1 . The flaw is located within an unknown functionality of the file /usr/bin/webmgnt , where manipulating the filename argument allows for remote path traversal. This vulnerability can be i...

CVE-2026-122013 Comfast CF-WR632AX Multipart webmgnt path traversal

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attac...

EUVD-2026-117099

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attac...

PT-2026-137147

Name of the Vulnerable Software and Affected Versions Comfast CF-WR632AX version 2.6.0.1 Description A path traversal issue exists in the Multipart Parser component of the /usr/bin/webmgnt file. Remote, unauthenticated attackers can access files outside the intended directory by manipulating the...

CVE-2026-121382: Netcore NBR100V2: A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msgaesdec of the file /usr/bin/autoac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized...

PT-2026-134682

Name of the Vulnerable Software and Affected Versions D-Link DIR-505 version 1.10B02 Description A stack-based buffer overflow exists in the TFTP Upload Filename Handler component within the /usr/bin/tftpd file. The issue occurs when the save upload file or mp upload file functions process a...

EUVD-2026-104669

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was...

CVE-2026-112370

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was...