CVE-2026-36698

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

CVE-2026-36698

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

EUVD-2026-109963

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

PT-2026-123355

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

CVE-2026-36698

Xovis AG products, including APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B (version 2.10.1.1 and earlier), are vulnerable to an OS command injection vulnerability in the /sbin/ImportParamSet.sh script. The flaw occurs because the script processes symlinks from uploaded parameter archiv...

TOTOLINK WA1200-PoE cstecgi.cgi DoS

The vulnerability of the cstecgi.cgi microprogramming system of the TOTOLINK WA1200-PoE router is related to errors in pointer assignment. Exploiting this vulnerability can allow a malicious actor to cause a service failure by sending a specially crafted HTTP request to the router’s management...

PT-2026-80971

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A buffer overflow occurs in the poe schedule profile function. This issue arises from the repeated concatenation of the start date, start time, duration time, how often, weekdays,...

Malicious code in @zalastax/nolb-poe (npm)

The package @zalastax/nolb-poe was found to contain malicious code. --- Credit: OpenSSF source...

AirLive - cgi_test.cgi RCE Detection (CVE-2015-2279)

Detects AirLive OS command injection via /cgitest.cgi?writetan&;id&id MD/BU models or manufacture Basic-auth wirelessmft WL/POE models. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive Boa cgitest.cgi OS command injection CVE-2015-2279.""" import base64 import re from kittysploit import from...

CVE-2026-9534

A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The...

CVE-2026-9515

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument pluginversion results in os command injection. The attack may be launched remotel...

CVE-2026-9511

A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument webWlanIdx leads to os command injection. It is possible to launch the attack remotely. The...

CVE-2026-9513

A weakness has been identified in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument hosttime can lead to os command injection. The attack can be launched remotely...

TOTOLINK CA750-PoE Setting component: Operating system command injection vulnerability

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK CA750-PoE: SetUploadUserData function vulnerability due to operating system command injection

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK CA750-PoE cstecgi.cgi file operating system command injection vulnerability

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK CA750-PoE Setting Handler component vulnerability due to operating system command injection

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

CVE-2026-9533

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Performing a manipulation of the argument fwUrl/magicid results in os command injection. It is possible to initiate...

CVE-2026-9534

Summary: Totolink CA750-PoE firmware 6.2c.510 is affected by a vulnerability in the Setting Handler (file /cgi-bin/cstecgi.cgi, function setWiFiWpsConfig). A manipulation of the PIN argument can lead to an OS command injection, and the attack can be launched remotely. The exploit has been publish...

CVE-2026-9531

A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The...