CVE-2025-3882 eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability

eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit th...

CVE-2025-44882

A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

eCharge Hardy Barth cPH2 操作系统命令注入漏洞

The eCharge Hardy Barth cPH2 is an electric vehicle charging station from eCharge. The eCharge Hardy Barth cPH2 suffers from an operating system command injection vulnerability that stems from the ntp parameter in the checkreq.php endpoint not being properly validated, which could lead to remote...

TOTOLINK N300RH url parameter command injection vulnerability

TOTOLINK N300RH is a long range wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK N300RH suffers from a command injection vulnerability that stems from the failure of the parameter url in the file /cgi-bin/cstecgi.cgi to correctly filter constructed command special characters,...

CVE-2009-5157

On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4pingipaddr variable...

EUVD-2025-16032

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

TOTOLINK A3002R Command Injection Vulnerability

TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a command injection vulnerability that stems from the FUN00459fdc function failing to properly filter constructed command special characters, commands, etc. The vulnerability can be...

CVE-2025-44881

CVE-2025-44881 describes a command-injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 caused by unfiltered input. Affected: Wavlink WL-WN579A3 (v1.0); vulnerable endpoint: /cgi-bin/qos.cgi; impact per sources indicates arbitrary command execution with network acc...

CVE-2025-4747 Bohua NetDragon Firewall ip_status.php command injection

A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ipstatus.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-4747 Bohua NetDragon Firewall ip_status.php command injection

A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ipstatus.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been...

PT-2025-21586 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU version 3.0.0-B20230809.1615 Description: A critical issue affects an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr...

TOTOLINK CA600-PoE CloudSrvUserdataVersionCheck function svn parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the CloudSrvUserdataVersionCheck function svn parameter failing to correctly filter constructed command special character...

TOTOLINK CA600-PoE CloudSrvUserdataVersionCheck function url parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the CloudSrvUserdataVersionCheck function url parameter failing to correctly filter constructed command special character...

Tenda W20E formSetNetCheckTools function command injection vulnerability

The Tenda W20E is a router from the Chinese company Tenda. The Tenda W20E suffers from a command injection vulnerability that stems from the formSetNetCheckTools function hostName parameter failing to correctly filter constructed command special characters, commands, and so on. No detailed...

TOTOLINK CA600-PoE setUpgradeFW Function Command Injection Vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the setUpgradeFW function failing to properly filter construct command special characters, commands, etc. No detailed...

TOTOLINK CA300-PoE Command Injection Vulnerability (CNVD-2025-10606)

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

TOTOLINK CA600-PoE CloudSrvUserdataVersionCheck function version parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the CloudSrvUserdataVersionCheck function version parameter failing to correctly filter the constructor command special...

TOTOLINK CA600-PoE NTPSyncWithHost Function Command Injection Vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the NTPSyncWithHost function failing to properly filter construct command special characters, commands, etc. No detailed...

TOTOLINK CPE CP900 setUploadUserData Function Command Injection Vulnerability

TOTOLINK CPE CP900 is an outdoor wireless CPE device from China Gion Electronics TOTOLINK. The TOTOLINK CPE CP900 suffers from a command injection vulnerability that stems from the setUploadUserData function failing to properly filter construct command special characters, commands, etc. No detail...

TOTOLINK CPE CP900 setApRebootScheCfg Function Command Injection Vulnerability

TOTOLINK CPE CP900 is an outdoor wireless CPE device from China Gion Electronics TOTOLINK. The TOTOLINK CPE CP900 suffers from a command injection vulnerability that stems from the setApRebootScheCfg function failing to correctly filter construct command special characters, commands, etc. No...