PT-2025-40405

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19 Description The Tenda AC18 version 15.03.05.19 contains a stack overflow. This occurs through the mac parameter within the fromAdvSetMacMtuWan function. Recommendations At the moment, there is no information abou...

CVE-2025-60660

CVE-2025-60660 affects Tenda AC18 firmware version 15.03.05.19. The vulnerability is a stack overflow in the fromAdvSetMacMtuWan function triggered by the mac parameter, as described by CNVD-2025-24471 and corroborated by NVD/Red Hat/CNNVD entries. Reported impact is denial of service. Public exp...

PT-2025-40407

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19 Description The Tenda AC18 router firmware contains a stack overflow issue. This occurs through the wanSpeed parameter within the fromAdvSetMacMtuWan function. Recommendations At the moment, there is no informati...

PT-2025-40406

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19 Description The Tenda AC18 version 15.03.05.19 contains a stack overflow issue. This occurs through the cloneType parameter within the fromAdvSetMacMtuWan function. Recommendations At the moment, there is no...

PT-2025-40255

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2053 B20230309 Description The software contains a command injection issue through the mac parameter within the setEasyMeshAgentCfg function. This allows for potential unauthorized command execution. Recommendation...

PT-2025-40254

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2053 B20230309 Description The software contains a command injection issue through the agentName parameter within the setEasyMeshAgentCfg function. This allows for potential unauthorized command execution...

CVE-2025-10991 Root Access via UART

The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907...

PT-2025-39924

Name of the Vulnerable Software and Affected Versions Tapo D230S1 versions prior to 1.2.2 Build 20250907 Description An attacker may gain root access by connecting to the UART port. This requires physical access to the device. Recommendations Update to version 1.2.2 Build 20250907 or later...

CVE-2025-11123

The CVE-2025-11123 entry concerns Tenda AC18 firmware 15.03.05.19. Affected component: the /goform/saveAutoQos function; root cause is manipulation of the enable parameter causing a stack-based buffer overflow. Impact is high across confidentiality, integrity, and availability, with remote (netwo...

CVE-2025-11091

A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been released to...

CVE-2025-57623

A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866B2022506 allows attackers to cause a Denial of Service...

CVE-2025-55848

CVE-2025-55848 affects the DIR-823 family (firmware 20250416). Root cause: the set_cassword/settings interface does not properly filter the http_casswd parameter, enabling code execution via injection of reverse-connection commands. Impact stated across sources is remote code execution with high ...

CVE-2025-11005

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458B20250708...

CVE-2025-11005 TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458B20250708...

CVE-2025-58069

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to protect the initial messages of a new KOPS session...

CVE-2025-10838

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and...

CVE-2025-55038

An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variabl...

VulnCheck KEV: CVE-2022-37932

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in...

CVE-2025-57623

A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866B2022506 allows attackers to cause a Denial of Service...

CVE-2025-52907 TOTOLINK X6000R Security Bypass Vulnerability

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360B20241207...