CVE-2025-51089

Tenda AC8V4 V16.03.34.06 was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument mac leads to heap-based buffer overflow...

CVE-2025-44651

In TRENDnet TPL-430AP FW1.0, the USERLIMITGLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected...

Netgear RAX30 安全漏洞

The NETGEAR RAX30 is a dual-band wireless router from NETGEAR. A security vulnerability exists in Netgear RAX30 version V1.0.10.94, which can be exploited by an attacker to potentially cause remote code execution...

CommScope Ruckus Unleashed 安全漏洞

CommScope Ruckus Unleashed is a wireless router from CommScope USA. A security vulnerability exists in versions prior to CommScope Ruckus Unleashed 200.15.6.12.304, which originates from the disclosure of the administrator password from the management endpoint and could lead to credential recover...

CVE-2025-34129

A command injection vulnerability exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the configuration interface can upload a malicio...

CVE-2025-34132

A command injection vulnerability exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvrbox fails to properly sanitize input, allowing remote attackers to inject and execute...

CVE-2025-34103

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

CVE-2025-34132

A command injection vulnerability exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvrbox fails to properly sanitize input, allowing remote attackers to inject and execute...

CVE-2025-34132

Summary: CVE-2025-34132 affects LILIN Digital Video Recorder (DVR) devices older than firmware version 2.0b60_20200207. The web service handling NTPUpdate config at /z/zbin/dvr_box does not properly sanitize input in the Server field, allowing a remote attacker to inject and execute arbitrary com...

CVE-2025-34132 LILIN DVR Command Injection via NTPUpdate in dvr_box

A command injection vulnerability exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvrbox fails to properly sanitize input, allowing remote attackers to inject and execute...

CVE-2025-34130

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 via the /z/zbin/nethtml.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to...

CVE-2025-34130 LILIN DVR Arbitrary File Read via net_html.cgi

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 via the /z/zbin/nethtml.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to...

CVE-2025-7673

A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50ABOM.5C0 could allow an unauthenticated attacker to cause denial-of-service DoS conditions and potentially execute arbitrary code by sending a specially crafted HTTP...

TOTOLINK N300RB 8.54 - Command Execution

Title: TOTOLINK N300RB 8.54 - Command Execution Author: Skander BELABED - Magellan Sécurité Date: 07/11/2025 Vendor: TOTOLINK Product: N300RB Firmware version: 8.54 CVE: CVE-2025-52089 Description: A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8....

ZEXELON ZWX-2000CSW2-HN和ZEXELON ZWX-2000CS2-HN 信任管理问题漏洞

The ZEXELON ZWX-2000CSW2-HN and the ZEXELON ZWX-2000CS2-HN are both a high-speed coaxial cable modem from ZEXELON Japan. A trust management issue vulnerability exists in the ZEXELON ZWX-2000CSW2-HN prior to version 0.3.19 and the ZEXELON ZWX-2000CS2-HN, which stems from hard-coded credentials and...

CVE-2025-52082

In Netgear XR300 V1.0.3.3810.3.30, a stack-based buffer overflow exists in the HTTPD service through the usbdevice.cgi endpoint. The vulnerability occurs when processing POST requests containing the readaccess parameter...

CVE-2025-6265

CVE-2025-6265 affects Zyxel NWA50AX PRO firmware versions 7.10(ACGE.2) and earlier. A path traversal vulnerability exists in the file_upload-cgi CGI program that could allow an authenticated administrator to access certain directories and delete files (e.g., the configuration file) on the device....

CVE-2025-7564

A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file /etc/shadow. The manipulation with the input root:blinkadmin leads to hard-coded credentials. Local access is required to approach this...

CVE-2025-7527

A vulnerability was found in Tenda FH1202 1.2.0.14408. It has been rated as critical. This issue affects the function fromAdvSetWan of the file /goform/AdvSetWan. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit...

PT-2025-29234

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RB firmware versions 8.54 Description: A hidden remote support feature, protected by a static secret, allows an authenticated attacker to execute arbitrary OS commands with root privileges. Recommendations: At the moment, there i...