EUVD-2026-88571

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/setonlineclient. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could b...

CVE-2026-101263

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw resides in the processing of the /api/ZRQos/set_online_client file, where manipulating the mac argument allows for remote command execution. While the vendor has not responded to the disclosure, the exploit ...

CVE-2026-101263 Ziroom ZHOME A0101 set_online_client command injection

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/setonlineclient. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could b...

CVE-2026-101075

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /locationtime.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is...

CVE-2026-101075

A critical OS command injection vulnerability exists in Netcore NR289-GE 1.4.5102 within the Location Time Handler component. The flaw resides in the system function of the /location_time.cgi file, where manipulating the mac argument allows for remote code execution. Public exploits for this vuln...

CVE-2026-101075: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /locationtime.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is...

PT-2026-99907

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the Location Time Handler component. The issue occurs when the mac argument is manipulated within the system function of the '/location time.cgi' endpoint,...

EUVD-2025-26402

A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-94138: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

PT-2026-96037

Name of the Vulnerable Software and Affected Versions Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 Description A remote command injection flaw exists in the /send order.cgi endpoint. The issue occurs when the mac argument is manipulated, allowing an attacker to execute...

EUVD-2026-35179

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack i...

CVE-2026-9477

A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is...

CVE-2026-9477

A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is...

CVE-2026-9477

A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is...

EUVD-2026-31710

A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is...

PT-2026-35378

Name of the Vulnerable Software and Affected Versions Tenda F456 version 1.0.0.5 Description A remote command injection issue exists in the httpd component. The problem occurs within the FromWriteFacMac function of the /goform/WriteFacMac file. Manipulation of the mac argument allows a remote...

CVE-2026-5153

The Tenda CH22 router (version 1.0.0.1 ) is vulnerable to remote command injection due to improper neutralization of special characters in the mac parameter. This flaw resides within the FormWriteFacMac function located in the /goform/WriteFacMac file. A remote attacker can exploit this vulnerabi...

CVE-2026-4554

A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-2082

CVE-2026-2082 affects D-Link DIR-823X (build 250416). The flaw lies in the /goform/set_mac_clone path where manipulating the argument mac allows an os command injection due to an identified vulnerable function. This enables remote attackers to execute commands with high privileges; exploitation i...

EUVD-2026-5731

A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/setmacclone. Such manipulation of the argument mac leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used...