CVE-2025-57175

CVE-2025-57175 affects Siklu EtherHaul 8010 devices (image siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b). The root cause is a static root password present in the affected firmware image. Impact is stated as high confidentiality/integrity/availability (per CVSS) with physical attack vector and hig...

CVE-2025-50649

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper input validation in the vlanname parameter in the /shutset.asp endpoint...

CVE-2026-31027

TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cstemodules/app.so. The vulnerability occurs because the rootSsid parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially...

CVE-2026-33201

Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code vulnerability. If this vulnerability is exploited, files or configurations on the affected device may be read or written, or arbitrary files may be executed with root privileges...

CVE-2026-22321

A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close. Because other CLI sessions remain...

The vulnerability of the functions thc_i2c_subip regsave() and thc_i2c_subip regs_restore() in the driver/hid/intel-thc-hid/intel-thc/intel-thc-dev.c module of the Linux kernel’s user interface subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions thci2csubip regsave and thci2csubip regs Restore in the driver/hid/intel-thc-hid/intel-thc/intel-thc-dev.c module of the Linux kernel’s user interface device subsystem is related to accessing memory beyond the permissible buffer data size due to arithmetic addre...

The vulnerability of the phy_config_inband() function in the drivers/net/phy/phy.c file of the Linux physical layer network driver kernel module allows a hacker to cause a service failure.

The vulnerability of the phyconfiginband function in the drivers/net/phy/phy.c file of the Linux physical layer network driver is related to mutual locking. Exploiting this vulnerability could allow a attacker to cause a service failure...

Hereta ETH-IMC408M 跨站脚本漏洞

The Hereta ETH-IMC408M is an Ethernet switch device produced by the Hereta company in the United States. Versions of Hereta ETH-IMC408M prior to 1.0.15 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper cleaning of the Device Location field, which could lead ...

CVE-2026-26793

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the setconfig function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

PT-2026-24728

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI...

PT-2026-24667

🚨 CVE-2026-3943 A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa portal auth local submit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public...

CVE-2026-3669

CVE-2026-3669 affects Freedom Factory dGEN1, specifically the AlarmService function in component com.dgen.alarm. The public disclosures describe local exploitation leading to improper authorization. Exploitation details beyond this are not provided in the available documents. Connected sources co...

Cisco Secure Firewall Adaptive Security Appliance Software TCP Flood Denial of Service Vulnerability

A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new,...

GCOM EPON 1GE 安全漏洞

GCOM EPON 1GE is a fiber-optic access device developed by GCOM Corporation. The GCOM EPON 1GE C00R371V00B01 version contains a security vulnerability. This vulnerability stems from improper permission escalation and access control mechanisms, which may allow remote authenticated users to modify...

Comfast CF-E7 命令注入漏洞

The Comfast CF-E7 is a wireless router produced by Comfast Corporation. The Comfast CF-E7 version 2.6.0.9 has a command injection vulnerability. This vulnerability stems from an incorrect handling of parameters in the function sub441CF4 of the webmggnt component’s...

PT-2026-21015

There is a new vulnerability with elevated criticality in D-Link DWR-M960 CVE-2026-2857 https://t.co/tVDOzLJGe3...

CVE-2025-63354

Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fails to properly handle inputs, allowing an attacker to inject and execute JavaScript...

CVE-2020-37149

Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery CSRF that can lead to command execution. An attacker can trick an authenticated user into submitting a crafted form to the /goform/mp endpoint, resulting in arbitrary command execution on the device with the user's...

CVE-2020-37149

Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery CSRF that can lead to command execution. An attacker can trick an authenticated user into submitting a crafted form to the /goform/mp endpoint, resulting in arbitrary command execution on the device with the user's...

CVE-2020-37092

Netis E1+ version 1.2.32533 contains a hardcoded root account vulnerability that allows unauthenticated attackers to access the device with predefined credentials. Attackers can leverage the embedded root account with a crackable password to gain full administrative access to the network device...