PT-2026-1870

Name of the Vulnerable Software and Affected Versions GL-iNet GL-AXT1800 router firmware version 4.6.8 Description A command injection issue exists in the plugins.install package RPC method. The method does not properly sanitize user input in package names, allowing authenticated attackers to...

PT-2026-1914

Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 6.30.1 React Router versions 7.0.0 through 7.9.5 Description An attacker-supplied path can be crafted to force a React Router application to perform a navigation or redirect to an external URL. This occurs...

CVE-2025-68717

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user'...

CVE-2025-65731: Missing Authentication for Critical Function

An issue was discovered in D-Link Router DIR-605L Hardware version F1; Firmware version: V6.02CN02 allowing an attacker with physical access to the UART pins to execute arbitrary commands due to presence of root terminal access on a serial interface without proper access control...

CVE-2025-67089: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.installpackage RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands wi...

CVE-2025-68718

The KAYSUS KS-WR1200 wireless router is vulnerable in firmware version 107 because it exposes SSH and TELNET services on the LAN interface using hardcoded root credentials (root:12345678 ). Attackers adjacent to the LAN can trivially log in with root privileges. The administrator is unable to dis...

CVE-2025-67089

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.installpackage RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands wi...

CVE-2025-68719

The KAYSUS KS-WR3600 wireless router running firmware version 1.0.5.9.1 is vulnerable to a configuration management flaw. If an attacker maintains an active user session, they can directly query the backup endpoint to download a full configuration archive. This archive contains sensitive files, s...

PT-2026-2137

Name of the Vulnerable Software and Affected Versions React Router versions 7.0.0 through 7.11.0 @remix-run/router versions prior to 1.23.2 Description React Router, a router for React, is susceptible to open redirect issues. Specifically, Single Page Applications SPAs using React Router and Remi...

PT-2026-2120

Name of the Vulnerable Software and Affected Versions @remix-run/react versions prior to 2.17.3 react-router versions 7.0.0 through 7.11.0 Description React Router, a router for React, contains a cross-site scripting XSS issue within the API when operating in Framework Mode during Server-Side...

PT-2026-1810

🟠 React Router, Cross-Site Request Forgery, CVE-2025-47216 Moderate https://t.co/LQdTXi1ca7...

GL-Inet GL-AXT1800 security vulnerabilities

The GL-Inet GL-AXT1800 is a WiFi6 wireless router from GL-Inet China. A security vulnerability exists in the GL-Inet GL-AXT1800 v4.6.8, which stems from improper input cleanup of the plugins.installpackage RPC method, which could lead to the execution of arbitrary commands...

D-Link DIR-605L security vulnerabilities

The D-Link DIR-605L is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-605L that stems from improper access control of the serial interface, which could lead to an arbitrary command execution attack...

KAYSUS KS-WR1200 Security Vulnerabilities

The KAYSUS KS-WR1200 is a wireless router from the Chinese company KAYSUS. A security vulnerability exists in the KAYSUS KS-WR1200 version 107, which originates from exposing SSH and TELNET services on the LAN interface with hard-coded credentials, which could lead to an attacker logging in with...

CVE-2025-68717

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user'...

KAYSUS KS-WR3600 security vulnerabilities

The KAYSUS KS-WR3600 is a wireless router from the Chinese company KAYSUS. A security vulnerability exists in the KAYSUS KS-WR3600 version 1.0.5.9.1, which originates from an authentication bypass during session authentication and could allow an unauthenticated attacker to retrieve sensitive...

CVE-2025-65731

The D-Link Router DIR-605L (Hardware version F1 , Firmware version V6.02CN02 ) is vulnerable to a hardware security flaw where the UART debug interface lacks proper access controls. An attacker with physical access to the device can connect to the UART pins to obtain unauthenticated root shell ac...

CVE-2025-65731

An issue was discovered in D-Link Router DIR-605L Hardware version F1; Firmware version: V6.02CN02 allowing an attacker with physical access to the UART pins to execute arbitrary commands due to presence of root terminal access on a serial interface without proper access control...

CVE-2025-15472

A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been published and may be...

CVE-2013-6918

The web interface on the Satechi travel router 1.5, when Wi-Fi is used for WAN access, exposes the console without authentication on the WAN IP address regardless of the "Web Management via WAN" setting, which allows remote attackers to bypass intended access restrictions via HTTP requests...