CVE-2025-49008 Atheos Improper Input Validation Vulnerability Enables RCE in Common.php

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable version...

The vulnerability of the formMapReboot() function (/boafrm/formMapReboot) in the TOTOLINK X15 router microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the formMapReboot function /boafrm/formMapReboot of the TOTOLINK X15 router’s microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the deviceMacAddr parameter. Exploiting this vulnerability allows a remot...

The vulnerability of the built-in boa server (/boafrm/formMapDel) of the Totolink X2000R router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the built-in server boa /boafrm/formMapDel of the Totolink X2000R router’s microprogramming software is related to the lack of data cleaning at the management level when processing the parameter devicemac1. Exploiting this vulnerability allows an attacker operating remotely t...

The vulnerability of the RP_checkFWByBBS() function in the microprogramming software for Linksys’ wireless signal amplifiers allows a hacker to execute arbitrary commands.

The vulnerability of the RPcheckFWByBBS function in the microprogramming software for Linksys wireless signal amplifiers is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the sub_456DE8() function in the jhttpd web server of the D-Link DI-500WF-WT router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the sub456DE8 function in the jhttpd web server of the D-Link DI-500WF-WT router microprogramming system is related to the lack of data cleaning measures at the control level when processing the cmd parameter. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the ssid1MACFilter() function in the Linksys wireless signal amplifiers’ software allows a hacker to execute arbitrary commands.

The vulnerability of the ssid1MACFilter function in the Linksys wireless amplifier software-related microprogramming system is related to the lack of measures to neutralize specific elements. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

CVE-2025-5606

A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/SetIPTVCfg. The manipulation of the argument list leads to command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-5440

A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument...

CVE-2025-5438

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The manipulation of the argument PIN leads ...

CVE-2025-5573

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been rated as critical. Affected by this issue is the function setSystemWizard/setSystemControl of the file /setSystemWizard. The manipulation of the argument AdminID leads to os command injection. The attack may be launched remotely. T...

CVE-2025-5571

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the file /setSystemAdmin. The manipulation of the argument AdminID leads to os command injection. It is possible to launch the attack remotely. The exploit has been...

Tenda AC18 安全漏洞

The Tenda AC18 is a router from the Chinese company Tenda. The Tenda AC18 suffers from a buffer overflow vulnerability that originates from a misuse of the parameter list in the file /goform/setPptpUserList, which can be exploited by an attacker to submit a special request and execute arbitrary...

CVE-2025-5525

CVE-2025-5525 affects Jrohy trojan up to version 2.15.3. The flaw is in the LogChan function (trojan/util/linux.go) where mishandling of the argument c enables os command injection. Exploitation can be performed remotely; attack complexity is described as high, with public disclosures available. ...

CVE-2025-5515

A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20230726.1108. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel. The manipulation of the argument devicemac1 leads to command injection. The attack may be launched...

CVE-2025-5502

A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to command injection. The attack may be launched...

CVE-2025-5492

A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub456DE8 of the file /mspinfo.htm?flag=cmd of the component /usr/sbin/jhttpd. The manipulation of the argument cmd leads to command injection. The attack...

The vulnerability of sub_42581C in the microprogrammed Wi-Fi router software of Tenda AX12 allows a hacker to execute arbitrary commands.

The vulnerability of sub42581C in Tenda AX12 Wi-Fi routers exists due to the lack of measures taken to neutralize special elements used in the operating system’s processing of the staticIp parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the runtime.InternetConnection() function in Linksys E5600 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the runtime.InternetConnection function in Linksys E5600 router microprogramming software is related to the lack of data cleaning measures at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-5447

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the...

CVE-2025-5447

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the...