EUVD-2026-67895

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51629

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-11834

CVE-2026-11834 PoC RCE non autenticata su DHCP Option 66 di TP-Link CVE-2026-11834 Panoramica Una vulnerabilità di iniezione di comandi CWE-78 nella gestione dell'Opzione 66 DHCP "TFTP Server Name" del firmware dei router TP-Link consente a un attaccante non autenticato sullo stesso segmento di...

USBCoercer

支持的目标平台| ESP32-S3 ---|--- USBCoercer：基于TinyUSB的WPAD强制设备 USBCoercer 将具备原生USB-OTG功能的ESP32开发板转变为以太网-over-USB 设备，能够通过WPAD强制代理配置。它基于 TinyUSB 网络控制模型（NCM） 示例构建，并添加了一个极简的DHCP服务器，用于注入 DHCP 选项 252（WPAD/PAC），此外还可以根据需要注入无类别静态路由（选项 121）以阻止EDR遥测。 该项目适用于安全测试和实验室演示。使用前务必获得明确授权。 主要特点 基于TinyUSB的USB NCM以太网设备...

DHCPig

DHCPig Validación de endurecimiento DHCP para whitehat: agota un pool, secuestra las concesiones de los vecinos, expulsa hosts de sus direcciones con ARP falsificado y reporta si la red te lo impidió. Requiere root y Python 3.11+. Ejecutar la interfaz web Debian / Kali: descarga el .deb más...

habu

Habu Hacking Toolkit Ich entwickle Habu, um Konzepte über Python und Netzwerk-Hacking zu lehren und zu lernen. Einige in der aktuellen Version implementierte Techniken sind: ARP-Vergiftung und -Sniffing DHCP-Entdeckung und -Aushungerung Subdomänen-Identifikation Zertifikats-Klonen TCP-Analyse ISN...

FEP3370-advanced-ethical-hacking

DynoRoot CVE-2018-1111 Abschlussprojekt für den Kurs Advanced Ethical Hacking an der KTH, Stockholm Dieses Projekt demonstriert eine bekannte Schwachstelle von Fedora- und RedHat-Rechnern im Zusammenhang mit einer unsicheren clientseitigen Implementierung des Dynamic Host Configuration Protocol...

freebsd-dhclient-poc

CVE-2020-7461 Reproducer PoC Autoren: Moshe Kol, Shlomi Oberman Reproducer PoC für die heap-basierte Pufferüberlauf-Schwachstelle in FreeBSD dhclient beim Parsen von DHCP-Option 119 CVE-2020-7461. Das Problem befindet sich in der Funktion findsearchdomainnamelen in der Datei...

CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – Bypass dello split‑tunneling VPN tramite iniezione di opzioni DHCP Codice del programma server DHCP e client simulati in Python root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...