1888 matches found
CVE-2025-22906
RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN...
CVE-2025-0457
The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...
CVE-2024-57014
CVE-2024-57014 affects TOTOLINK X5000R, specifically version V9.1.0cu.2350_B20230313. The vulnerability is an OS command injection in the setScheduleCfg function triggered by the recHour parameter, enabling arbitrary command execution. Multiple connected sources corroborate the issue but do not s...
CVE-2024-57012
CVE-2024-57012 relates to TOTOLINK X5000R routers (V9.1.0cu.2350_B20230313). Multiple connected sources confirm an OS command-injection in the setScheduleCfg function, triggered by the week parameter due to improper filtering of command characters, enabling arbitrary command execution. The vulner...
PT-2025-3387 · Totolink · Totolink X5000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0cu.2350 B20230313 Description: The issue is related to an OS command injection vulnerability. This vulnerability can be exploited through the sHour parameter in the setWiFiScheduleCfg function. Recommendations: Fo...
CVE-2024-57015
TOTOLINK X5000R is affected by CVE-2024-57015. The vulnerability is an OS command injection via the hour parameter in setScheduleCfg on version V9.1.0cu.2350_B20230313, caused by inadequate filtering of constructed command characters. Impact is described as arbitrary command execution with high s...
CVE-2024-39759
Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...
CVE-2024-39367
An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2024-34544
A command injection vulnerability exists in the wireless.cgi AddMac functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2024-34544
CVE-2024-34544 affects the Wavlink AC3000 family (M33A8.V5030.210505). The vulnerability resides in wireless.cgi AddMac() where an unfiltered POST parameter (addMac) is copied to the heap and later used in an sprintf, then passed to system(), enabling arbitrary command execution after an authenti...
CVE-2024-39784
CVE-2024-39784 is a confirmed command-injection vulnerability in Wavlink AC3000, affecting the NAS CGI (nas.cgi) add_dir() function. Talos reports the flaw resides in processing of the disk_part POST parameter (and related adddir_name in a parallel CVE-2024-39785 path), enabling arbitrary shell c...
CVE-2024-56497
An improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or...
Wavlink AC3000 qos.cgi qos_sta() command injection vulnerability
Talos Vulnerability Report TALOS-2024-2047 Wavlink AC3000 qos.cgi qossta command injection vulnerability January 14, 2025 CVE Number CVE-2024-36295 SUMMARY A command execution vulnerability exists in the qos.cgi qossta functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP...
CVE-2024-5743 Command Injection Vulnerability
An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code. This issue affects Eve Play: through 1.1.42...
TOTOLINK A6000R reset_wifi command injection vulnerability
The TOTOLINK A6000R is a high-performance wireless router that utilizes advanced technology and design to provide users with an outstanding networking experience. TOTOLINK A6000R suffers from a command injection vulnerability, which originates from the devname parameter of the resetwifi function,...
Bug Bounty Report: Command Injection Vulnerability in subprocess Call
This report is not public...
CVE-2024-57228
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vifdisable function...
CVE-2024-57212
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the actionreboot function...