Wavlink WL-WN578W2 命令注入漏洞

The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. Wavlink WL-WN578W2 221110 version exists a command injection vulnerability, the vulnerability stems from the parameter pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled of the function...

CVE-2025-57278

The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800B10ALKSLV01.01.02P42U1406 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or...

ALSA-2025:15661 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/vkms: Fix use after free and double free on init error CVE-2025-22097 kernel: scsi: lpfc: Use memcpy for BIOS version CVE-2025-38332 kernel: posix-cpu-timers: fix race between...

kernel: scsi: lpfc: Use memcpy() for BIOS version

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy for BIOS version The strlcat with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset with...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2025-57571

The CVE-2025-57571 incident affects the Tenda F3 router (firmware 12.01.01.48_multi and later). The vulnerability is a Buffer Overflow in the macFilterList parameter of the goform/setNAT endpoint, caused by insufficient validation of input length. Reported impact is Denial of Service; no exploita...

PT-2025-37072

Name of the Vulnerable Software and Affected Versions: Tenda F3 versions V12.01.01.48 multi and after Description: The Tenda F3 is susceptible to a buffer overflow condition due to the portList parameter within the /goform/setNAT API endpoint. Recommendations: At the moment, there is no informati...

CVE-2025-57572

CVE-2025-57572 affects the Tenda F3 router (versions 12.01.01.48_multi and later). The vulnerability is a buffer overflow in the goform/setParentControl handling of the onlineList parameter, caused by improper validation of input length. This can lead to a denial of service. Multiple sources conf...

CVE-2025-10159

The CVE-2025-10159 issue affects Sophos AP6 Series Wireless Access Points running firmware older than 1.7.2563 (MR7). A bypass in authentication allows remote attackers with network access and no user interaction to obtain administrative privileges, as described in the vulnerability description a...

CVE-2025-10159

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 MR7...

CVE-2025-57078

Tenda G3 v3.0brV15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex parameter in the formModifyPppAuthWhiteMac function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-57064

Tenda G3 v3.0brV15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-57061

Tenda G3 v3.0brV15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark parameters. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-57061

The CVE-2025-57061 entry concerns Tenda G3 firmware (v3.0br_V15.11.0.17) with multiple stack overflows in the formIPMacBindModify function. The issue is triggered by crafted requests using the parameters ruleId, ip, mac, v6, and remark, leading to Denial of Service. Red‑team like details show a D...

CVE-2025-52547

E3 Site Supervisor Control firmware version 2.31F01 MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services...

CVE-2025-52543

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

CVE-2025-9935

A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function sub4159F8 of the file /webcste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed an...

JVN#65839588: Web Caster V130 vulnerable to cross-site request forgery

Web Caster V130 provided by NTT EAST, Inc. and NTT WEST, Inc. is a 050IP telephony-enabled broadband router. Web Caster V130 contains the following vulnerability. Cross-site request forgery CWE-352 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N Base Score 2.0...

CVE-2024-48705

Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...

CVE-2025-52547

E3 Site Supervisor Control firmware version 2.31F01 MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services...