FreeMDU

FreeMDU FreeMDU プロジェクトは、Miele 製機器の光学診断インターフェースを介した通信のためのオープンハードウェアおよびソフトウェアツールを提供します。これは、登録されたサービス技術者のみが利用できるプロプライエタリな Miele Diagnostic Utility MDU ソフトウェアに対する、無料かつオープンな代替手段として機能します。 1996 年以降に製造されたほとんどの Miele 機器には、フロントパネルのインジケーターランプの背後に、光学赤外線ベースの診断インターフェースが組み込まれています。古い機器では、このインターフェースは Program...

MARMALADE-2-CVE-2025-67780-Exploit

MARMALADE 2/CVE-2025-67780 漏洞利用（PoC） 针对 Starlink 天线中 MARMALADE 2（CVE-2025-67780）漏洞的 PoC 漏洞利用代码 阅读我的完整博客，了解我是如何发现该漏洞以及如何让它按你的意愿执行：https://www.akawlabs.com/blog/starlink-grpc-execution 我开发了多个概念验证实现，证明本地网络上的 Starlink 天线可被强制重启。问题源于天线诊断接口所暴露的某些 gRPC 命令缺少充分的身份验证和白名单限制。 在向 SpaceX...

Linux Distros Unpatched Vulnerability : CVE-2026-82070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected...

CVE-2026-82070

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic...

Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic...

CVE-2026-71947

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...

CVE-2026-71948

Affected product/versions: D-Link DWR-M961, hardware version C1, firmware before 1.1.5_C1_202607071108. Vulnerability: command injection via the /boafrm/formDebugDiagnosticRun interface; remote attacker can inject arbitrary commands into the host field, leading to root-level command execution. Im...

Security Bulletin: This Power System update is being released to address CVE-2026-8058

Summary The BMC's diagnostic interface is affected. Vulnerability Details CVEID:CVE-2026-8058 DESCRIPTION: OPENBMC allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it. CWE:CWE-200: Exposure of Sensitive...

CVE-2026-4769

The affected product family is WAGO System I/O Field series devices. The CVE describes an undocumented internal diagnostic capability that activates during the initial startup sequence and remains accessible without authentication for a brief window in the early boot phase. During this window, an...

CVE-2026-4769 Unauthenticated Access to Internal Diagnostic Interface

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an...

CVE-2026-4769 Unauthenticated Access to Internal Diagnostic Interface

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an...

EUVD-2026-42002

Uncaught Exception CWE-248 in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: 9.50 prior t...

CVE-2026-27844

Uncaught Exception CWE-248 in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: 9.50 prior t...

CVE-2026-5511 Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72

In the web management interface of Archer AX72 SG v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information. An authenticated attacker with administrative privileges could exploit this issue to confirm the...

CVE-2026-5511

The CVE-2026-5511 entry affects TP-Link Archer AX72 (SG) in its web management interface. The network diagnostic feature improperly handles invalid input, allowing an authenticated administrator to confirm the diagnostic utility’s presence and view its valid command-line syntax and options. The i...

CVE-2026-5511 Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72

In the web management interface of Archer AX72 SG v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information. An authenticated attacker with administrative privileges could exploit this issue to confirm the...

CVE-2026-31847

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can...

CVE-2026-31847 Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can...

CVE-2026-31847

CVE-2026-31847 concerns Nexxt Solutions Nebula 300+ devices running firmware up to 12.01.01.37. A hidden functionality in the /goform/setSysTools endpoint can remotely enable Telnet, which then exposes a privileged diagnostic management interface over the network. This increases attack surface an...

PT-2026-27114

Name of the Vulnerable Software and Affected Versions Nexxt Solutions Nebula 300+ versions prior to 12.01.01.38 Description Hidden functionality in the '/goform/setSysTools' endpoint allows an authenticated attacker to remotely enable a Telnet service on port 23. This is achieved by sending a...