NewStart CGSL MAIN 7.02 : wpa_supplicant Vulnerability (NS-SA-2026-0037)

The remote NewStart CGSL host, running version MAIN 7.02, has wpasupplicant packages installed that are affected by a vulnerability: - The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop...

PT-2026-28701

Name of the Vulnerable Software and Affected Versions Totolink LR350 version 9.3.5u.6369 B20220309 Description A buffer overflow issue exists in the setWiFiGuestCfg function of the /cgi-bin/cstecgi.cgi file. The issue is triggered by manipulating the ssid argument. The exploit for this issue has...

CVE-2026-32721

A flaw was found in LuCI, the OpenWrt Configuration Interface. A remote attacker can exploit a stored Cross-Site Scripting XSS vulnerability in the wireless scan modal by crafting a malicious Wi-Fi network name SSID. When a user opens the wireless scan modal, the unsanitized SSID is rendered as r...

CVE-2026-32721 LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal

LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passe...

CVE-2026-4043 Tenda i12 wifiSSIDget formwrlSSIDget stack-based overflow

A security vulnerability has been detected in Tenda i12 1.0.0.62204. The impacted element is the function formwrlSSIDget of the file /goform/wifiSSIDget. Such manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclos...

CVE-2026-3807

A security vulnerability has been detected in Tenda FH1202 1.2.0.14408. Impacted is the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Such manipulation of the argument mitssid/mitssidindex leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has...

EUVD-2026-8978

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code execution when the configuration is...

CVE-2026-25196

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code execution when the configuration is...

PT-2026-21406

Name of the Vulnerable Software and Affected Versions Tenda HG9 300001138 Description A stack-based buffer overflow exists in Tenda HG9 300001138. The issue is located in an unknown function of the file /boaform/formWlanSetup within the Wireless Configuration Endpoint component. Manipulation of t...

Tenda A21 安全漏洞

The Tenda A21 is a wireless signal extender produced by the Chinese company Tenda. Version 1.0.0.0 of the Tenda A21 contains a security vulnerability. This vulnerability stems from the formfastsettingwifiset function in the/goform/fastsettingwifiset file, where there is a stack buffer overflow du...

CVE-2025-65128

A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "nocommit" and supplying the...

PT-2026-7623

Name of the Vulnerable Software and Affected Versions Shenzhen Zhibotong Electronics ZBT WE2001 version 23.09.27 Description A flaw exists in the web management API components that allows unauthenticated attackers on the local network to modify router and network configurations. Attackers can...

CVE-2026-2139

A vulnerability was determined in Tenda TX9 up to 22.03.02.10multi. Affected by this vulnerability is the function sub432580 of the file /goform/fastsettingwifiset. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly...

CVE-2020-37150

Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizardreboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and security key. Attackers can retrieve the wireless password by sending a GET request to this endpoint, exposing sensitive information without...

CVE-2020-37097 Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)

Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencryptwiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi network name and plaintext password stored in device...

CVE-2020-37093 Netis E1+ 1.2.32533 - Unauthenticated WiFi Password Leak

Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcoreget.cgi endpoint. Attackers can send a GET request to the endpoint to extract sensitive network credentials including SSID and WiFi passwords in...

PT-2026-5846

Name of the Vulnerable Software and Affected Versions Edimax EW-7438RPn version 1.13 Description The Edimax EW-7438RPn version 1.13 contains a flaw that allows disclosure of WiFi network configuration details. An attacker can access the wlencrypt wiz.asp file to retrieve sensitive information,...

CVE-2025-70651

Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the formfastsettingwifiset function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

PT-2026-3773

Name of the Vulnerable Software and Affected Versions Tenda AX-1803 version 1.0.0.1 Description The Tenda AX-1803 router contains a stack overflow in the ssid parameter of the form fast setting wifi set function. This issue allows attackers to cause a Denial of Service DoS by sending a crafted...

CVE-2026-1158

A security flaw has been discovered in Totolink LR350 9.3.5u.6369B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can be...