CVE-2025-55423

A command injection vulnerability exists in the upnprelay function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system without proper validation or sanitization, allowing OS command injection...

TOTOLINK LR350 Router DoS

The vulnerability of the setWizardCfg function in TOTOLINK LR350 router microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the parameter ssid. Exploiting this vulnerability allows an attacker to cause a service failure by...

Tenda AX3 DoS

The vulnerability of the fromAdvSetMacMtuWan function in the Tenda AX3 Wi-Fi router software lies in the fact that the operation’s results are stored outside of the buffer in memory when processing the wanSpeed2 parameter. Exploiting this vulnerability could allow a remote attacker to cause a...

UTT 520W Router strcpy Heap Buffer Overflow DoS

The vulnerability of the strcpy function in the UTT 520W router software lies in the fact that the operation’s output goes beyond the buffer boundaries during the processing of the wepkey1 parameter. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

D-Link DIR-806A Command Injection Vulnerability

The D-Link DIR-806A is a wireless router from China's AUO D-Link. A command injection vulnerability exists in the D-Link DIR-806A version 100CNb11, which stems from the failure of the ssdpcgimain function in the SSDP Request Handler component to correctly filter constructed command special...

UTT HiPER 810 security vulnerability

UTT HiPER 810 is an intelligent broadband router developed by UTT Corporation. Version 1.7.4-141218 of UTT HiPER 810 contains a security vulnerability. This vulnerability arises from incorrect handling of the parameter passwd1 in the file/goform/setSysAdm, which may lead to a buffer overflow...

TOTOLINK LR350 security vulnerabilities

TOTOLINK LR350 is a wireless router produced by TOTOLINK Corporation. The TOTOLINK LR350 9.3.5u.6369B20220309 version contains a security vulnerability. This vulnerability stems from incorrect handling of the parameter “ssid” in the file /cgi-bin/cstecgi.cgi, which may lead to a buffer overflow...

CVE-2021-47820 Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)

Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Attackers can craft a malicious webpage that automatically submits a form to change router remote access settings to port 8080 without the user's consent...

CVE-2025-68707

An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise...

NETGEAR XR1000v2 security vulnerabilities

The NETGEAR XR1000v2 is a wireless router from NETGEAR. A security vulnerability exists in the NETGEAR XR1000v2 that stems from insufficient input validation and could lead to OS command injection...

Tenda 4G03 Pro Arbitrary Command Execution

The vulnerability of the web interface of Tenda 4G03 Pro microprogramming software for routers is related to the lack of measures taken to protect data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a specially crafted...

UTT 512W strcpy() Code Execution

The vulnerability of the strcpy function in the UTT 512W router microprogramming system is related to copying buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted POST request...

TRENDnet TEW-800MB Command Injection Vulnerability

The TRENDnet TEW-800MB is a dual-band wireless router from TRENDnet. The TRENDnet TEW-800MB suffers from a command injection vulnerability that originates from a misbehavior of the function subF934 in the file NTPSyncWithHost.cgi, which can be exploited by an attacker to execute arbitrary command...

TRENDnet TEW-822DRE Command Injection Vulnerability

The TRENDnet TEW-822DRE is a dual-band wireless router from TRENDnet. The TRENDnet TEW-822DRE suffers from a command injection vulnerability that originates from a misuse of the parameter peerPin in the file /boafrm/formWsc, which can be exploited by an attacker to execute arbitrary commands on t...

UTT HiPER 840G strcpy Buffer Overflow DoS

The vulnerability of the strcpy function in the /goform/formTaskEdit module of the UTT HiPER 840G microprogramming router software is related to the use of memory after deallocation. Exploiting this vulnerability could allow an attacker to cause service failure...

react-router cross-site scripting vulnerability

react-router is a Remix open source declarative routing for React. A cross-site scripting vulnerability exists in react-router versions 7.0.0 through 7.8.2, which stems from a cross-site scripting vulnerability when generating script:ld+json tags in framework mode, which could lead to the executi...

CVE-2023-43128

D-LINK DIR-806 1200M11AC wireless router DIR806A1FW100CNb11 is vulnerable to command injection due to lax filtering of HTTPST parameters...

CVE-2023-43862

D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function...

CVE-2018-19612

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

CVE-2021-33269

D-Link DIR-809 devices with firmware through DIR-809AxFW1.12WWB0320190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN8004776c in /formVirtualServ. This vulnerability is triggered via a crafted POST request...