CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-लिंक राउटर OS कमांड इंजेक्शन अधिक जानकारी के लिए देखें https://vulners.com/cve/CVE-2026-3227 एक स्थायी, प्रमाणित OS कमांड इंजेक्शन भेद्यता TP-लिंक राउटर फर्मवेयर में जो डिवाइस को ब्रिक करने या संभावित LAN अधिग्रहण की ओर ले जाती है। अस्वीकरण : इस रिपॉजिटरी में एक पैच की गई भेद्यत...

CVE-2023-33538

استغلال بايثون لثغرة حقن الأوامر في أجهزة TP-Link TL-WR940N/TL-WR841N تعليمات الاستخدام 1. التحقق الأساسي من الثغرة : root@kitploit: python tplinkexploit.py -t 192.168.1.1 -u admin -p admin 2. تنفيذ أمر مخصص : root@kitploit: python tplinkexploit.py -t 192.168.1.1 -u admin -p admin -c...

CVE-2024-57376

CVE-2024-57376 استغلال تنفيذ أوامر عن بُعد قبل المصادقة لأجهزة D-Link DSR-250 وDSR-250N النشرة الأمنية: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 الاستخدام root@kitploit: $ python3 exploit.py usage: مثال root@kitploit: $ python3 exploit.py 192.168.1.1 443 id...

blogpost_cve-2018-19987-analysis

تحليل CVE-2018-19987 حقن أوامر نظام التشغيل في D-Link مرحبًا! في هذا المقال القصير، سأشرح تحليلاً سريعًا قمت به لفهم التفاصيل وراء CVE-2018-19987 بشكل أفضل. في البداية، بحثت عن هذه الثغرة لأنني اعتقدت أنه لا توجد معلومات عامة أو استغلال. بعد وقت قصير من إجراء التحليل الأول، وجدت اثنين من PoCs...

CVE-2026-11834

CVE-2026-11834 PoC ثغرة RCE غير مصادق عليها في خيار DHCP 66 بمنتجات TP-Link CVE-2026-11834 نظرة عامة تسمح ثغرة حقن أوامر CWE-78 في معالجة خيار DHCP 66 "اسم خادم TFTP" في برنامج تشغيل أجهزة توجيه TP-Link لمهاجم غير مصادق عليه على نفس قطاع الشبكة بتنفيذ أوامر تعسفية بصلاحيات الجذر. عندما يعمل الجها...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35869

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35868

A command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-link Router AC2100_AZ3 V1.0.4 . Insufficient validation and sanitization of user-supplied input before it reaches a system-level command execution context allows an unauthenticated, rem...

CVE-2026-35869

A Command Injection vulnerability in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0 allows unauthenticated, network-based attackers to execute arbitrary operating system commands. The root cause is insufficient validation and sanitization of user-s...

CVE-2026-35869

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

EUVD-2026-51669

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

The vulnerability in the webfile_mgrc.ipl software for D-Link DNS-320 allows a hacker to execute arbitrary commands.

The vulnerability in the webfilemgrc.cgi script of the D-Link DNS-320 network storage software exists due to the lack of measures taken to neutralize special elements used in the operating system’s command syntax. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

CVE-2026-11492

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to...

CVE-2026-11492

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to...

CVE-2026-11341

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEIvalue causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-11339

A vulnerability affects D-Link DWR-M920 firmware up to version 1.1.50 . The flaw is located in the function sub_41CF20 within the file /boafrm/formUSSDSetup ; manipulating the argument ussdValue enables command injection . It can be exploited remotely, and multiple sources note that the exploit i...

EUVD-2026-34859

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may ...

📄 D-Link DSL2600U Password Disclosure

D-Link DSL2600U suffers from an administrative password disclosure vulnerability. Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure Date: 2026-05-02 Exploit Author: Amir Hossein Jamshidi Vendor Homepage: https://www.dlink.com Version: DSL-2600U Tested on: ubuntu CVE : N/A Firmwar...

D-Link DSL2600U - 'rom-0' Admin Password Disclosure

Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure Date: 2026-05-02 Exploit Author: Amir Hossein Jamshidi Vendor Homepage: https://www.dlink.com Version: DSL-2600U Tested on: ubuntu CVE : N/A Firmware Version: v1.08 from routersploit.libs.lzs.lzs import LZSDecompress import reques...