CVE-2025-9580 LB-LINK BL-X26 HTTP set_blacklist os command injection

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-9580

CVE-2025-9580 affects LB-LINK BL-X26 v1.2.8. The vulnerability lies in the HTTP Handler’s /goform/set_blacklist where manipulating the mac argument enables OS command injection. Exploitation is possible remotely and publicly disclosed; at least one advisory notes exploitation and lack of vendor r...

Metasploit Weekly Wrap-Up 08/28/2025

New module content 2 Pretalx Arbitrary File Read/Limited File Write Authors: Stefan Schiller and msutovsky-r7 Type: Auxiliary and Exploit Pull request: 20480 contributed by msutovsky-r7 Path: auxiliary/scanner/http/pretalxfilereadcve202328459 and exploit/linux/http/pretalxrcecve202328458 Attacker...

CVE-2025-52054

An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate wit...

Malicious code in oneauth-mac (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41585 Malicious code in oneauth-mac (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-52054

The Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router is vulnerable in Firmware 16.03.33.05 due to an improper authentication procedure. The device calculates the root password using a predictable method: a static string combined with the last two octets of the device's MAC address . This f...

📄 Remote for Mac 2025.6 Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution vulnerability in Remote for Mac 2025.6. When the "Allow unknown devices" setting is enabled, it is possible to simulate keyboard input via UDP packets without authentication. By sending a sequence of key presses, an attacker...

CVE-2025-52054

An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate wit...

LB-LINK BL-X26 安全漏洞

LB-LINK BL-X26 is a wireless router from China Bilink LB-LINK. A security vulnerability exists in the LB-LINK BL-X26 version 1.2.8, which originates from an incorrect operation of the parameter mac in the file /goform/setblacklist resulting in os command injection...

COMFAST CF-N1 安全漏洞

COMFAST CF-N1 is a wireless router from China Four Seas Zonglian COMFAST. A security vulnerability exists in COMFAST CF-N1 version 2.6.0, which originates from a command injection due to incorrect operation of the parameter mac in the file /usr/bin/webmgnt...

PT-2025-37371

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN578W2 version 221110 Description: A vulnerability exists in Wavlink WL-WN578W2. The issue resides in the sub 404DBC function of the /cgi-bin/wireless.cgi file. Manipulation of the macAddr argument can lead to operating system...

CVE-2025-52054: Improper Authentication

An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate wit...

CVE-2025-9580: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-9523

A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public an...

CVE-2025-9523 Tenda AC1206 GetParentControlInfo stack-based overflow

A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public an...

PT-2025-34859

Name of the Vulnerable Software and Affected Versions: Tenda AC1206 version 15.03.06.23 Description: A stack-based buffer overflow vulnerability exists in the GetParentControlInfo function of the /goform/GetParentControlInfo file. Manipulation of the mac argument can trigger the vulnerability,...

CVE-2025-9523: Stack-based Buffer Overflow

A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public an...

Tenda AC1206 安全漏洞

The Tenda AC1206 is a wireless gigabit router from Tenda China. A security vulnerability exists in the Tenda AC1206 version 15.03.06.23, which originates from a stack buffer overflow due to incorrect manipulation of the mac parameter in the file /goform/GetParentControlInfo...

PT-2025-34930 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.06.23 multi Description: The Tenda AC6 device contains a buffer overflow issue through the list parameter within the fromSetIpMacBind function. Recommendations: At the moment, there is no information about a newer...