EUVD-2026-67910

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51615

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51615

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the getLanCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain LAN addressing and DHCP configuration information , representing an informati...

CVE-2026-51616

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51629

An incorrect access control flaw in the getStaticDhcpRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers to obtain static DHCP reservation rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability exposes DHCP reserv...

CVE-2026-51616

CVE-2026-51616 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). The vulnerability stems from an incorrect access control in the getWanIeCfg function, allowing unauthenticated attackers to send a crafted POST request to /cgi-bin/cstecgi.cgi and obtain LAN addressing and DHCP confi...

CVE-2026-51629

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67911

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67895

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

USBCoercer

支持的目标平台| ESP32-S3 ---|--- USBCoercer：基于TinyUSB的WPAD强制设备 USBCoercer 将具备原生USB-OTG功能的ESP32开发板转变为以太网-over-USB 设备，能够通过WPAD强制代理配置。它基于 TinyUSB 网络控制模型（NCM） 示例构建，并添加了一个极简的DHCP服务器，用于注入 DHCP 选项 252（WPAD/PAC），此外还可以根据需要注入无类别静态路由（选项 121）以阻止EDR遥测。 该项目适用于安全测试和实验室演示。使用前务必获得明确授权。 主要特点 基于TinyUSB的USB NCM以太网设备...

DHCPig

DHCPig Validación de endurecimiento DHCP para whitehat: agota un pool, secuestra las concesiones de los vecinos, expulsa hosts de sus direcciones con ARP falsificado y reporta si la red te lo impidió. Requiere root y Python 3.11+. Ejecutar la interfaz web Debian / Kali: descarga el .deb más...

habu

Habu Hacking Toolkit Ich entwickle Habu, um Konzepte über Python und Netzwerk-Hacking zu lehren und zu lernen. Einige in der aktuellen Version implementierte Techniken sind: ARP-Vergiftung und -Sniffing DHCP-Entdeckung und -Aushungerung Subdomänen-Identifikation Zertifikats-Klonen TCP-Analyse ISN...

freebsd-dhclient-poc

CVE-2020-7461 Reproducer PoC Autoren: Moshe Kol, Shlomi Oberman Reproducer PoC für die heap-basierte Pufferüberlauf-Schwachstelle in FreeBSD dhclient beim Parsen von DHCP-Option 119 CVE-2020-7461. Das Problem befindet sich in der Funktion findsearchdomainnamelen in der Datei...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...