TOTOLINK A950RG 安全漏洞

TOTOLINK A950RG is an ultra-generation Giga wireless router from China's Gion Electronics TOTOLINK that supports high-speed network connectivity and multi-device management. The TOTOLINK A950RG suffers from a command injection vulnerability that stems from a failure to properly filter construct...

PT-2025-46847

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619 B20230130 within the cstecgi.cgi binary sub 41EC68 function. The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is...

CVE-2025-60696

A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers Firmware FWv2.0.152112301012. The arplookup function parses lines from /proc/net/arp using sscanf"%16s ... %18s ...", storing results into buffers v6 12 bytes and v7 20 bytes. Since the form...

CVE-2025-55810

A vulnerability was found in Alaga Home Security WiFi Camera 3K model S-CW2503C-H with hardware version V03 and firmware version 1.4.2, which allows physical attackers to execute commands as root via script file with a specific name on a SD card...

CVE-2025-60694

A stack-based buffer overflow exists in the validatestaticroute function of the httpd binary on Linksys E1200 v2 routers Firmware E1200v2.0.11.001us.tar.gz. The function improperly concatenates user-supplied CGI parameters routeipaddr03, routenetmask03, routegateway03 into fixed-size buffers v6,...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28628)

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28630)

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial...

CVE-2022-4982

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers frame.html and frame.A100.html that accept a path parameter content or sidebar which is not properly validated or canonicalized. An attacker c...

CVE-2022-4982 DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers frame.html and frame.A100.html that accept a path parameter content or sidebar which is not properly validated or canonicalized. An attacker c...

PT-2025-47844

Name of the Vulnerable Software and Affected Versions D-Link DIR-822K versions 1.00 20250513164613 and 1.1.50 D-Link DWR-M920 versions 1.00 20250513164613 and 1.1.50 Description A buffer overflow issue exists in D-Link DIR-822K and DWR-M920 routers. The issue is related to the manipulation of the...

PT-2025-46734

Name of the Vulnerable Software and Affected Versions Tinycontrol LAN Controller versions up to 1.58a hardware v3.8 Description The Tinycontrol LAN Controller v3 LK3 firmware has a missing authentication check. An attacker who is not authenticated can send specially crafted requests to the stm.cg...

EUVD-2025-93538

Improper input validation in NETGEAR DGN2200v4 N300 Wireless ADSL2+ Modem Router allows attackers with direct network access to the device to potentially execute code on the device. Please check the firmware version and update to the latest. Fixed in: DGN2200v4 firmware 1.0.0.132 or later...

CVE-2025-12940

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points. An user having access to the syslog server can read the logs containing these credentials. This issue affects...

CVE-2025-12940 Credentials recorded in logs in NETGEAR WAX610 and WAX610Y

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points. An user having access to the syslog server can read the logs containing these credentials. This issue affects...

CVE-2025-63153

TOTOLink A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

PT-2025-46371

Name of the Vulnerable Software and Affected Versions NETGEAR RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router versions prior to 1.0.14.108 NETGEAR RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router versions prior to 1.0.9.82 Description A flaw exists in the firmware update logic due to improper...

EUVD-2025-50808

Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the urls parameter of the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

EUVD-2025-48947

Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-63834

A stored cross-site scripting XSS vulnerability was discovered in Tenda AC18 v15.03.05.05multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage...

Tenda AX3 安全漏洞

Tenda AX3 is a home dual-band Gigabit wireless router from Tenda Technology that supports Wi-Fi6 802.11ax standard and focuses on high-performance network coverage and stable connection. The Tenda AX3 suffers from a stack buffer overflow vulnerability, which stems from the deviceId parameter of t...