JVN#22016482: Seiko Solutions SkyBridge BASIC MB-A130 vulnerable to OS command injection

SkyBridge BASIC MB-A130 provided by Seiko Solutions Inc. contains the following vulnerability. OS command injection CWE-78 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8 CVE-2025-54857 Impact A remote...

D-Link DIR-852 安全漏洞

D-Link DIR-852 is a dual-band Gigabit wireless router from Youxun Technology, focusing on home networking solutions and supporting Xunlei remote download function. The D-Link DIR-852 suffers from an os command injection vulnerability, which stems from the parameter service in the file soap.cgi...

CVE-2025-9745 D-Link DI-500WF jhttpd version_upgrade.asp os command injection

A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /versionupgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit ha...

CVE-2025-9745

CVE-2025-9745 affects D-Link DI-500WF (firmware 14.04.10A1T). The vulnerability is in jhttpd’s /version_upgrade.asp where manipulating the path argument enables an OS command injection. Exploitation is remote and publicly disclosed (at least a PoC exists). Connected sources corroborate the affect...

CVE-2025-9727 D-Link DIR-816L soap.cgi soapcgi_main os command injection

A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgimain of the file /soap.cgi. This manipulation of the argument service causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-9727

CVE-2025-9727 affects D-Link DIR-816L firmware 206b01. The issue lies in the soapcgi_main function of /soap.cgi, where the service argument can be manipulated to trigger an OS command injection. Remote exploitation is possible, and public exploits exist. Several connected sources confirm the vuln...

CVE-2024-46484

TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component...

CVE-2025-53508

Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive information may be obtained. As for the details of affected product names and versions, refer to the information under Product Status...

CVE-2025-53508

CVE-2025-53508 affects iND Co.,Ltd embedded devices including HL330-DLS (MC7700/MC7330 variants), HL320-DLS, LM-100, LM-200 (AMP570/EC25-J variants), L2X Assist, L2X Assist-RS-A/E, F2L Assist-SS-A/E. Root cause is OS command injection allowing an arbitrary OS command to be executed, potentially l...

CVE-2024-46484

TRENDnet TV-IP410 vA1.0R is affected by an OS command injection in /server/cgi-bin/testserv.cgi. The root cause is improper handling of input that allows commands to be executed with high impact on confidentiality, integrity, and availability (CVSS v3.1: 9.8, Network, No auth, User interaction no...

CVE-2025-9580

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-9580 LB-LINK BL-X26 HTTP set_blacklist os command injection

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-9580

CVE-2025-9580 affects LB-LINK BL-X26 v1.2.8. The vulnerability lies in the HTTP Handler’s /goform/set_blacklist where manipulating the mac argument enables OS command injection. Exploitation is possible remotely and publicly disclosed; at least one advisory notes exploitation and lack of vendor r...

PT-2025-34975

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: SS1 versions 16.0.0.10 and earlier Media version 16.0.0a and earlier allow a remote, unauthenticated attacker to upload arbitrary files and execute OS...

CVE-2025-9528

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit has been publicly...

CVE-2025-9528 Linksys E1700 systemCommand os command injection

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit has been publicly...

Linksys E1700 安全漏洞

The Linksys E1700 is a wireless router from Linksys, USA. A security vulnerability exists in Linksys E1700 version 1.0.0.4.003, which stems from an incorrect operation of the parameter command in the file /goform/systemCommand resulting in os command injection...

Ruijie WS7204-A 安全漏洞

Ruijie WS7204-A is a wireless controller from Ruijie China. A security vulnerability exists in the Ruijie WS7204-A version 2017.06.15, which originates from an incorrect operation of the parameter providence in the file /itboxpi/branchimport.php?a=branchlist that results in os command injection...

Linux Distros Unpatched Vulnerability : CVE-2017-7413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde...

Linux Distros Unpatched Vulnerability : CVE-2017-7414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In HordeCrypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled i...