CVE-2025-28036: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28035: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A830R V4.1.2cu.5182B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28037: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A810R V4.1.2cu.5182B20201026 and A950RG V4.1.2cu.5161B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter...

CVE-2025-28037

TOTOLINK A810R V4.1.2cu.5182B20201026 and A950RG V4.1.2cu.5161B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter...

TOTOLINK EX1200T 安全漏洞

The TOTOLINK EX1200T is a dual-band wireless signal amplifier that is primarily used to extend the coverage of an existing wireless network. A code execution vulnerability exists in the TOTOLINK EX1200T. The vulnerability stems from the FileName parameter in the setUpgradeFW function for...

The vulnerability of the SafeInspect privilege control system lies in its failure to eliminate special elements used in the operating system’s command set, allowing a violator to execute arbitrary commands.

The vulnerability of the SafeInspect privilege control system lies in the lack of measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to remotely execute arbitrary commands...

PT-2025-17570 · Totolink · Totolink A950Rg

Name of the Vulnerable Software and Affected Versions: TOTOLINK A950RG version 4.1.2cu.5161 B20200903 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setNoticeCfg function and can be exploited through the NoticeUrl parameter. Recommendations: For...

PT-2025-17543 · Totolink · Totolink A3100R +5

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 TOTOLINK A810R version 4.1.2cu.5182 B20201026 TOTOLINK A830R version 4.1.2cu.5182 B20201102 TOTOLINK A950RG version 4.1.2cu.5161 B20200903 TOTOLINK A3000RU version 5.9c.5185 B20201128 TOTOLINK...

CVE-2025-28035

The TOTOLINK A830R (version V4.1.2cu.5182_B20201102) is vulnerable to a pre-auth remote command execution vulnerability. The issue originates from the setNoticeCfg function in the microprogramming software, which fails to properly neutralize special characters in the NoticeUrl parameter. An unaut...

CVE-2025-28036

The TOTOLINK A950RG router (firmware version V4.1.2cu.5161_B20200903 ) is vulnerable to a pre-authentication remote command execution (RCE) flaw. This vulnerability exists in the setNoticeCfg function due to a failure to properly neutralize special elements within the NoticeUrl parameter. An unau...

PT-2025-17569 · Totolink · Totolink A830R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A830R version 4.1.2cu.5182 B20201102 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setNoticeCfg function and can be exploited through the NoticeUrl parameter. Recommendations: For...

CVE-2025-29659

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmdlisten" function located in the "cmd" binary...

CVE-2025-29659

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmdlisten" function located in the "cmd" binary...

Yi IOT XY-3820 安全漏洞

Yi IOT XY-3820 is a wireless security camera from Yi IOT. A security vulnerability exists in the Yi IOT XY-3820 version 6.0.24.10, which stems from the cmdlisten function in the cmd binary being vulnerable to remote command execution attacks...

CVE-2025-29659

The Yi IOT XY-3820 wireless security camera, specifically version 6.0.24.10 , is vulnerable to Remote Command Execution (RCE) . The root cause is located in the cmd_listen function within the cmd binary, which allows for the unauthorized execution of commands. This vulnerability could potentially...

CVE-2025-29659: Improper Authorization

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmdlisten" function located in the "cmd" binary...

CVE-2025-29659

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmdlisten" function located in the "cmd" binary...

PT-2025-17440 · Yi · Yi Iot Xy-3820

Name of the Vulnerable Software and Affected Versions: Yi IOT XY-3820 version 6.0.24.10 Description: The issue concerns a Remote Command Execution vulnerability via the cmd listen function located in the cmd binary. This allows for unauthorized execution of commands, potentially leading to a full...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Erlang vulnerability (USN-7443-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7443-1 advisory. Fabian Bumer, Marcel Maehren, Marcus Brinkmann, and Jrg Schwenk discovered that Erlang OTPs SSH module incorrect handled...

The vulnerability of the exec() function in the icepay.php script of the MagnusBilling VoIP system allows a hacker to execute arbitrary commands.

The vulnerability of the exec function in the icepay.php script of the MagnusBilling VoIP system is related to the failure to take measures to neutralize special elements used in the operating system’s commands when processing the democ parameter. Exploiting this vulnerability allows a remote...