CVE-2024-12297 Frontend Authorization Logic Disclosure Vulnerability

Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable...

PT-2025-1189

Name of the Vulnerable Software and Affected Versions MGate 5121/5122/5123 Series firmware version v1.0 Description A stored Cross-site Scripting XSS vulnerability exists due to insufficient sanitization and encoding of user input in the Login Message functionality. An authenticated attacker with...

PT-2025-1139 · Tenda · Tenda Ac1200 Smart Dual-Band Wifi Router

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 Smart Dual-Band WiFi Router Model AC6 version 2.0 Firmware v15.03.06.50 Description: The issue is related to incorrect access control in the Tenda AC1200 Smart Dual-Band WiFi Router, which allows attackers to bypass authenticatio...

CVE-2024-39773

An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2024-39294

A buffer overflow vulnerability exists in the adm.cgi setwzdgw4G functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-11864

Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP...

PT-2025-2532 · Wavlink · Wavlink Ac3000

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 version M33A8.V5030.210505 Description: A firmware update issue exists in the fw check.sh functionality. This allows an attacker to perform a man-in-the-middle attack using a specially crafted HTTP request, potentially leading ...

PT-2025-1703

Name of the Vulnerable Software and Affected Versions SCP-Firmware versions up to and including 2.15.0 Description Specifically crafted SCMI messages sent to an SCP may lead to a Usage Fault and crash the SCP. Recommendations For SCP-Firmware versions up to and including 2.15.0, consider...

CVE-2024-57223

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcliwpsgenpincode function...

CVE-2024-57228

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vifdisable function...

CVE-2025-22949

Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution...

CVE-2025-22946

Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution...

CVE-2025-22946

CVE-2025-22946 affects Tenda AC9 v1.0 firmware v15.03.05.19. The issue is a stack overflow in the /goform/SetOnlineDevName endpoint, which may allow remote arbitrary code execution. Connected sources confirm the vulnerability and affected component but do not provide a published fix version or pa...

CVE-2024-43658 Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.

Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmware for AC model before firmware version 25010801. Likelihood: High, but requires authentication Impact: Critical – The vulnerability can be...

PT-2025-2651 · Iocharger · Iocharger

Name of the Vulnerable Software and Affected Versions: Iocharger firmware for AC models versions prior to 24120701 Description: The issue is related to an improper neutralization of special elements used in a command, also known as 'Command Injection', which allows OS Command Injection as root...

PT-2025-2649 · Iocharger · Iocharger

Name of the Vulnerable Software and Affected Versions: Iocharger firmware for AC models versions prior to 24120701 Description: The issue is related to command injection in a specific parameter of a .exe request, leading to remote code execution as the root user. This allows an attacker to have...

CVE-2024-12430

An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. After successfully exploiting CVE-2024-12429 directory traversal, a successfully authenticated attacker can inject arbitrary commands into a...

CVE-2024-12429

An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A successfully authenticated attacker can use this vulnerability to read system wide files and configuration All AC500 V3 products PM5xxx with...

CVE-2024-12429

An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A successfully authenticated attacker can use this vulnerability to read system wide files and configuration All AC500 V3 products PM5xxx with...

CVE-2024-12429

An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A successfully authenticated attacker can use this vulnerability to read system wide files and configuration All AC500 V3 products PM5xxx with...