D-Link DIR-852 os Command Injection Vulnerability

D-Link DIR-852 is a dual-band Gigabit wireless router from Youxun Technology, focusing on home networking solutions and supporting Xunlei remote download function. The D-Link DIR-852 suffers from an os command injection vulnerability, which stems from the parameter service in the file soap.cgi...

CVE-2025-56498

An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit...

D-Link DIR-816L /soap.cgi file os command injection vulnerability

The D-Link DIR-816L is a dual-band wireless router that supports 2.4GHz and 5GHz bands with a maximum transfer rate of 450Mbps. The D-Link DIR-816L suffers from an os command injection vulnerability that stems from the parameter service in the file /soap.cgi failing to correctly filter constructe...

Seiko Solutions SkyBridge BASIC MB-A130 vulnerable to OS command injection

Overview SkyBridge BASIC MB-A130 provided by Seiko Solutions Inc. contains the following vulnerability. OS command injection CWE-78 - CVE-2025-54857 Tsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

CVE-2025-9752

CVE-2025-9752 affects D-Link DIR-852 with firmware 1.00CN B09 in the SOAP Service’s soap.cgi, specifically the soapcgi_main function. A manipulation of the argument named in the soap.cgi service parameter leads to OS command injection. The vulnerability is exploitable remotely and has publicly di...

CVE-2025-9752 D-Link DIR-852 SOAP Service soap.cgi soapcgi_main os command injection

A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgimain of the file soap.cgi of the component SOAP Service. Such manipulation of the argument service leads to os command injection. The attack can be launched remotely. The exploit has been...

JVN#22016482: Seiko Solutions SkyBridge BASIC MB-A130 vulnerable to OS command injection

SkyBridge BASIC MB-A130 provided by Seiko Solutions Inc. contains the following vulnerability. OS command injection CWE-78 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8 CVE-2025-54857 Impact A remote...

D-Link DIR-852 安全漏洞

D-Link DIR-852 is a dual-band Gigabit wireless router from Youxun Technology, focusing on home networking solutions and supporting Xunlei remote download function. The D-Link DIR-852 suffers from an os command injection vulnerability, which stems from the parameter service in the file soap.cgi...

CVE-2025-9745 D-Link DI-500WF jhttpd version_upgrade.asp os command injection

A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /versionupgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit ha...

CVE-2025-9745

CVE-2025-9745 affects D-Link DI-500WF (firmware 14.04.10A1T). The vulnerability is in jhttpd’s /version_upgrade.asp where manipulating the path argument enables an OS command injection. Exploitation is remote and publicly disclosed (at least a PoC exists). Connected sources corroborate the affect...

CVE-2025-9727

CVE-2025-9727 affects D-Link DIR-816L firmware 206b01. The issue lies in the soapcgi_main function of /soap.cgi, where the service argument can be manipulated to trigger an OS command injection. Remote exploitation is possible, and public exploits exist. Several connected sources confirm the vuln...

CVE-2025-9727 D-Link DIR-816L soap.cgi soapcgi_main os command injection

A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgimain of the file /soap.cgi. This manipulation of the argument service causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2024-46484

TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component...

CVE-2025-53508

Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive information may be obtained. As for the details of affected product names and versions, refer to the information under Product Status...

CVE-2025-53508

CVE-2025-53508 affects iND Co.,Ltd embedded devices including HL330-DLS (MC7700/MC7330 variants), HL320-DLS, LM-100, LM-200 (AMP570/EC25-J variants), L2X Assist, L2X Assist-RS-A/E, F2L Assist-SS-A/E. Root cause is OS command injection allowing an arbitrary OS command to be executed, potentially l...

CVE-2024-46484

TRENDnet TV-IP410 vA1.0R is affected by an OS command injection in /server/cgi-bin/testserv.cgi. The root cause is improper handling of input that allows commands to be executed with high impact on confidentiality, integrity, and availability (CVSS v3.1: 9.8, Network, No auth, User interaction no...

CVE-2025-9580

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-9580 LB-LINK BL-X26 HTTP set_blacklist os command injection

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-9580

CVE-2025-9580 affects LB-LINK BL-X26 v1.2.8. The vulnerability lies in the HTTP Handler’s /goform/set_blacklist where manipulating the mac argument enables OS command injection. Exploitation is possible remotely and publicly disclosed; at least one advisory notes exploitation and lack of vendor r...

CVE-2025-9528

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit has been publicly...