CVE-2026-31173

ToToLink A3300R firmware v17.0.0cu.557_B20221024 is affected. A flaw in /cgi-bin/cstecgi.cgi allows execution of arbitrary commands via the interval parameter. CVSS 3.1: Network attack, Privileges Required NONE, User Interaction NONE, Impact Confidentiality and Integrity LOW, Availability NONE; b...

CVE-2026-31171

CVE-2026-31171 affects ToToLink A3300R firmware v17.0.0cu.557_B20221024. The issue allows an attacker to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi, as described in multiple sources (EUVD/NVD/CVE listings). The root cause and exact vulnerable component are described ...

CVE-2026-31174

CVE-2026-31174 describes a command-injection vulnerability in ToToLink A3300R firmware 17.0.0cu.557_B20221024. An attacker can exploit the vulnerability by supplying crafted input to the informEnable parameter of the web CGI endpoint /cgi-bin/cstecgi.cgi, potentially executing arbitrary commands ...

CVE-2026-31164

ToToLink A3300R firmware v17.0.0cu.557_B20221024 is vulnerable to command execution via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi. The CVE-2026-31164 entry notes this as a network-based vulnerability with CVSSv3.1: 6.5 (MEDIUM), requiring no privileges and no user interaction. Connected sour...

CVE-2026-31166

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-31177

The CVE-2026-31177 entry affects ToToLink A3300R firmware (example: v17.0.0cu.557_B20221024). The root cause is an input handling flaw in the stunMinAlive parameter passed to /cgi-bin/cstecgi.cgi, enabling an attacker to execute arbitrary commands. Impact is high (remote, unauthenticated network ...

CVE-2026-38834

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the dopingaction function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2026-6058

UNSUPPORTED WHEN ASSIGNED An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00ABDV.3C0 could allow an adjacent attacker on the WLAN to cause a denial-of-service DoS condition in the web management interface by convincing an authenticated...

CVE-2026-6058

UNSUPPORTED WHEN ASSIGNED An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00ABDV.3C0 could allow an adjacent attacker on the WLAN to cause a denial-of-service DoS condition in the web management interface by convincing an authenticated...

CVE-2026-38835

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

MINI-FW3H-85P2-Q682

Bulletin has no description...

CVE-2026-37100

An issue in the Bluetooth Low Energy BLE control interface of the Yamaha SR-B30A sound bar firmware 2.40 Mobile App: Sound Bar Remote / version: 2.40 allows remote attackers within BLE radio range to connect without authentication via the Sound Bar Remote protocol...

CVE-2026-37100

CVE-2026-37100 affects Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote 2.40). The BLE control interface allows remote attackers within BLE range to connect without authentication through the Sound Bar Remote protocol. Affected component: Bluetooth Low Energy (BLE) control int...

EUVD-2026-22057

A flaw has been found in Tenda F456 1.0.0.5. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Executing a manipulation of the argument mitssid can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publish...

Ubiquiti UniFi Play PowerAmp和Ubiquiti UniFi Play Audio Port 安全漏洞

Both the Ubiquiti UniFi Play PowerAmp and the Ubiquiti UniFi Play Audio Port are products of the American company Ubiquiti. The Ubiquiti UniFi Play PowerAmp is a home audio control device that supports multi-room audio distribution and amplifier integration. The Ubiquiti UniFi Play Audio Port is ...

Tenda F451 安全漏洞

The Tenda F451 is a wireless router produced by the Chinese company Tenda. Version 1.0.0.7 of the Tenda F451 contains a security vulnerability. This vulnerability stems from an improper handling of the page parameter in the fromDhcpListClient function within the httpd component, which may lead to...

VulnCheck KEV: CVE-2024-57046

A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the the requested url, it will be recognized as passing the authentication...

PT-2026-32154

A flaw has been found in Tenda F451 1.0.0.7. Affected by this vulnerability is the function WrlclientSet of the file /goform/WrlclientSet of the component httpd. This manipulation of the argument GO causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been...

CVE-2025-50654

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of the id parameter in the /thdmember.asp endpoint...

TOTOLINK A7100RU 操作系统命令注入漏洞

The TOTOLINK A7100RU is a wireless router produced by TOTOLINK Corporation. The Totolink A7100RU 7.4cu.2313b20191024 version contains an operating system command injection vulnerability. This vulnerability stems from the setTelnetCfg function in the CGI Handler component’s file...