LongBow

Archer TP-Link VR1600V ルーター ローカルリモートコマンド実行エクスプロイト CVE-2023-31756 概要 このPythonスクリプトは、Archer TP-Link VR1600V V1/V2ルーターにおけるローカルリモートコマンド実行の脆弱性を実証します。このエクスプロイトにより、ルーター上で管理者レベルのオペレーティングシステムアクセスが可能になります。このアクセスにより、OpenVPNサーバーを再び有効にしたり、Webポータルから制限されているCWMPやその他の管理タスクを無効にしたりできます。 前提条件...

CVE-2025-9961

CVE-2025-9961 TP-Link AX10/AX1500 CWMP 버퍼 오버플로 RCE 개요 CWMPTR-069의 스택 기반 버퍼 오버플로로 인해 원격 코드 실행이 가능합니다. 필드| 값 ---|--- 제품| TP-Link AX10, AX1500 영향받는 버전| AX10 B"Malicious ACS" B -- C"SetParameterValues" C -- D"Stack Overflow" D -- E"Overwrite PC" E -- F"ret2libc" F -- G"system" G -- H"RCE" 기술 세부 사항 이...

The vulnerability of the CWMP/TR-069 protocol implementation in TP-Link Archer VX1800v V1 software allows a hacker to execute arbitrary code with root privileges, resulting in complete system compromise.

The vulnerability of the CWMP/TR-069 protocol implementation of TP-Link Archer VX1800v V1 software lies in the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root...

...[ More ]

Tozed ZLT X300 5G CPE Router firmware version 6.01.3 contains an OS command injection vulnerability in the TR-069/CWMP client daemon netcwmpd. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, which constructs a shell command executed via systembyroot as root. An attacker...

EUVD-2026-43962

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CVE-2026-15427

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CVE-2026-15427 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CVE-2026-15427: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CGA-73RG-X23W-CWMP

Bulletin has no description...

CVE-2025-67113

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

EUVD-2025-208883

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

CVE-2025-67113

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

CVE-2025-67113

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

CVE-2025-67113

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

CVE-2025-67113

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

CVE-2025-67113: Improper Control of Generation of Code

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

Sercomm SCE4255W 安全漏洞

Sercomm SCE4255W is a broadband gateway device produced by Sercomm in Taiwan, China. Previous versions of Sercomm SCE4255W, including DG3934v3@2308041842, contained security vulnerabilities. These vulnerabilities stemmed from OS command injection in the CWMP client, which could allow remote...

CVE-2023-53881

ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by...

CVE-2023-53881: Cleartext Transmission of Sensitive Information

ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by...

CVE-2025-56089

OS Command Injection vulnerability in Ruijie M18 EW3.01B11P226M1810223116 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...