CVE-2026-2035703-x300

CVE-2026-2035703: Tozed ZLT X300 5G CPE — تنفيذ كود عن بُعد بصلاحيات الجذر عبر محطة قاعدة وهمية بتقنية SDR الحالة: تحت الإفصاح المنسق فترة حظر 90 يومًا تاريخ الاكتشاف: 2026-08-08 الباحث: Muhammad Nadeem Danish danish1162 معرف CVE: CVE-2026-2035703 الخطورة: حرجة CVSS 9.8 CWE: CWE-78 حقن أوامر نظام...

EUVD-2025-23640

Malicious code in bioql PyPI...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

PT-2025-31946

Name of the Vulnerable Software and Affected Versions Jointelli 5G CPE 21H01 firmware version 1.36 Description Jointelli 5G CPE 21H01 firmware version 1.36 contains a blind OS command injection issue. Multiple API endpoints are vulnerable, including /ubus/?flag=set WPS pin, /ubus/?flag=netAppStar...

CVE-2025-43978: Improper Neutralization of Special Elements used in an OS Command

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2025-43978

The Jointelli 5G CPE 21H01 router, running firmware version JY_21H01_A3_v1.36 , is vulnerable to a (blind) OS command injection flaw. The issue resides in multiple API endpoints, specifically /ubus/?flag=set_WPS_pin, /ubus/?flag=netAppStar1, and /ubus/?flag=set_wifi_cfgs. An authenticated attacke...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-48440

Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component atcommand.asp...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-28726

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted payload to the Diagnostics function...

CVE-2024-28728

The DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 (version DWR-2000M 1.34ME ) and Dlink DWR 5G CPE (version DWR-2000M 1.34ME ) are vulnerable to a Cross Site Scripting (XSS) vulnerability. A local attacker can exploit this by sending a crafted payload to the WiFi SSID Name field to obtain sensitive i...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-28729: Improper Neutralization of Special Elements used in a Command

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

PT-2024-22545

Name of the Vulnerable Software and Affected Versions DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 version 1.34ME Dlink DWR 5G CPE DWR-2000M version 1.34ME Description The issue allows a local attacker to obtain sensitive information via the Port forwarding option. This is related to a Cross Site...

CVE-2024-28728: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via a crafted payload to the WiFi SSID Name field...

CVE-2024-28730: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via the file upload feature of the VPN configuration module...

CVE-2024-28726

The DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE (specifically version DWR-2000M_1.34ME ) are vulnerable to a command injection flaw. A local attacker can execute arbitrary code by sending a crafted payload to the Diagnostics function . The root cause is identified as a lack of ...

CVE-2024-28731: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via the Port forwarding option...