PT-2025-40407

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19 Description The Tenda AC18 router firmware contains a stack overflow issue. This occurs through the wanSpeed parameter within the fromAdvSetMacMtuWan function. Recommendations At the moment, there is no informati...

PT-2025-40254

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2053 B20230309 Description The software contains a command injection issue through the agentName parameter within the setEasyMeshAgentCfg function. This allows for potential unauthorized command execution...

PT-2025-40255

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version V9.1.0cu.2053 B20230309 Description The setEasyMeshAgentCfg function in the TOTOLINK X18 router firmware does not properly sanitize data at the management level when processing the mac parameter. This can allow a remote...

CVE-2025-10991 Root Access via UART

The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907...

PT-2025-39924

Name of the Vulnerable Software and Affected Versions Tapo D230S1 versions prior to 1.2.2 Build 20250907 Description An attacker may gain root access by connecting to the UART port. This requires physical access to the device. Recommendations Update to version 1.2.2 Build 20250907 or later...

CVE-2025-11123

The CVE-2025-11123 entry concerns Tenda AC18 firmware 15.03.05.19. Affected component: the /goform/saveAutoQos function; root cause is manipulation of the enable parameter causing a stack-based buffer overflow. Impact is high across confidentiality, integrity, and availability, with remote (netwo...

CVE-2025-11091

A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been released to...

CVE-2025-57623

A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866B2022506 allows attackers to cause a Denial of Service...

CVE-2025-55848

The D-Link DIR-823X wireless router contains a Remote Code Execution (RCE) vulnerability in its set_cassword() settings interface. The root cause is the lack of proper input validation or cleaning for the http_casswd parameter, which fails to filter special characters like & . This allows an atta...

CVE-2025-11005

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458B20250708...

CVE-2025-11005 TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458B20250708...

CVE-2025-58069

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to protect the initial messages of a new KOPS session...

CVE-2025-10838

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and...

CVE-2025-55038

An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variabl...

VulnCheck KEV: CVE-2022-37932

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in...

CVE-2025-57623

A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866B2022506 allows attackers to cause a Denial of Service...

CVE-2025-52907 TOTOLINK X6000R Security Bypass Vulnerability

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360B20241207...

CVE-2025-52906 TOTOLINK X6000R Command Injection Vulnerability

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360B20241207...

CVE-2025-52906

Summary (grounded in provided documents): TOTOLINK X6000R firmware versions up to and including V9.4.0cu.1360_B20241207 are affected by an OS Command Injection caused by improper neutralization of special elements in OS commands. This vulnerability could allow an attacker to execute arbitrary com...

CVE-2025-56241

The Aztech DSL5005EN wireless router, specifically running firmware version 1.00.AZ_2013-05-10 and potentially other versions, is vulnerable to an improper access control flaw. An unauthenticated attacker can send a crafted POST request to the sysAccess.asp endpoint to change the administrator pa...