CVE-2025-34035

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

CVE-2025-34035

EnGenius EnShare Cloud Service version 1.4.11 and earlier is vulnerable to an OS command injection vulnerability. The usbinteract.cgi script fails to properly sanitize user input provided to the path parameter, allowing unauthenticated remote attackers to inject and execute arbitrary shell comman...

CVE-2025-34033 5VTechnologies Blue Angel Software Suite OS Command Injection

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the pingaddr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can...

CVE-2025-34033 5VTechnologies Blue Angel Software Suite OS Command Injection

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the pingaddr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can...

CVE-2025-34033

CVE-2025-34033 affects the Blue Angel Software Suite on embedded Linux devices. The vulnerability is an OS command injection in the webctrl.cgi script through the ping_addr parameter, where input is not properly sanitized before being passed to the system-level ping command. An authenticated atta...

CVE-2025-34033: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the pingaddr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can...

PT-2025-26684 · Sapido · Sapido Brc76N +11

Name of the Vulnerable Software and Affected Versions: Sapido BR071n version All Sapido BR261c version All Sapido BR270n version All Sapido BR476n version All Sapido BRC70n version All Sapido BRC70x version All Sapido BRC76n version All Sapido BRD70n version All Sapido BRE70n version All Sapido...

CVE-2025-34037: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcpip parameter without sanitization, allowing...

CVE-2025-48890: Improper Neutralization of Special Elements used in an OS Command

WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in miniigd SOAP service. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be...

PT-2025-26693 · Unknown · Wrc-X3000Gs

Name of the Vulnerable Software and Affected Versions: WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This occurs in the...

CVE-2025-41427: Improper Neutralization of Special Elements used in an OS Command

WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary ...

CVE-2025-34041: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response EDR management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interfac...

PT-2025-26695 · Unknown · Wrh-733Gbk +1

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the telnet function. A remote...

JVN#39435597: Multiple vulnerabilities in ELECOM wireless LAN routers

Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Unrestricted upload of file with dangerous type CWE-434 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score 4...

CVE-2025-34035: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

CVE-2025-6559: Improper Neutralization of Special Elements used in an OS Command

Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended...

PT-2025-26696 · Unknown · Wrh-733Gbk +1

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the miniigd SOAP service. A remote...

PT-2025-26662

Name of the Vulnerable Software and Affected Versions: EnGenius EnShare Cloud Service versions 1.4.11 and earlier Description: An OS command injection issue exists due to the usbinteract.cgi script's failure to properly sanitize user input passed to the path parameter. This allows unauthenticated...

CVE-2025-34036: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When th...

PT-2025-26663

Name of the Vulnerable Software and Affected Versions: TVT DVR Cross Web Server affected versions not specified Description: An OS command injection issue exists in the custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in...