CVE-2026-15427 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

The vulnerability of the TR-069 protocol implementation (tr069/tr069_uci.c) in network board microcomputer software from ASR Microelectronics, such as ASR1803L, ASR1806, ASR1901, and ASR1903L, allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of the TR-069 protocol implementation tr069/tr069uci.c of networking devices from ASR Microelectronics’ ASR1803L, ASR1806, ASR1901, and ASR1903L models is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an unauthorized attacker to ga...

The vulnerability of the TR-069 protocol implementation (tr069/tr098.c) of the network board microprogramming software from ASR Microelectronics, including models ASR1803L, ASR1806, ASR1901, and ASR1903L, allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of the TR-069 protocol implementation tr069/tr098.c of the network board microcomputer software ASR Microelectronics ASR1803L, ASR1806, ASR1901, and ASR1903L is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an unauthorized attacker...

Exploit for External Control of File Name or Path in Emagicone Emagicone_Store_Manager_For_Woocommerce

eMagicOne Store Manager for WooCommerce md5 EMOSMCDEFAULT...

PT-2025-3266 · Axess · Axess Acs

Name of the Vulnerable Software and Affected Versions: AXESS ACS Auto Configuration Server versions prior to 5.2.0 Description: The issue is related to unsanitized user input in the TR069 API, which allows remote unauthenticated attackers to cause a permanent Denial of Service via crafted TR069...

GenieACS 操作系统命令注入漏洞

GenieACS is a high-performance automatic configuration server ACS for remote management of TR-069-enabled devices. GenieACS is vulnerable to an OS command injection vulnerability, which stems from inadequate input validation and lack of authorization checks, and can be exploited by attackers to...

Unspecified vulnerability in the Grandstream HT800 series

The Grandstream HT800 series is an HT800 series analog phone adapter from Grandstream. An input validation error vulnerability exists in the Grandstream HT800 series using firmware version 1.0.17.5 and earlier. The vulnerability stems from a failure of the system to properly validate incoming dat...

DrayTek Vigor AP910C Cross-Site Request Forgery Vulnerability

DrayTek Vigor AP910C devices is a wireless router product with firewall function from DrayTek. A cross-site request forgery vulnerability exists in DrayTek Vigor AP910C devices using firmware version 1.2.0RC3 build r6594. A remote attacker could exploit the vulnerability to open SNMP on a remote...

TR-069 Auto Configuration Server Arbitrary Code Execution Vulnerability (CNVD-2015-00281)

TR-069 is the DSL Forum Technical Specification "CPE WAN Management Protocol CWMP", which defines the application layer protocol for remote management of end devices. An arbitrary code execution vulnerability exists in some server implementations of the TR-069 protocol. A remote attacker could...

TR-069 Auto Configuration Server Arbitrary Code Execution Vulnerability (CNVD-2015-00280)

TR-069 is the DSL Forum Technical Specification "CPE WAN Management Protocol CWMP", which defines the application layer protocol for remote management of end devices. Arbitrary code execution vulnerabilities exist in certain server implementations of TR-069. These vulnerabilities can be exploited...