TOTOLINK Realtek SD Routers - Remote Command Injection

TOTOLINK Realtek SDK based routers may allow an authenticated attacker to execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0,...

NETGEAR - Authentication Bypass

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations. id:...

WAVLINK WN579X3 - Remote Command Execution

Remote Command Execution vulnerability in WAVLINK WN579X3 routers via pingIp parameter in /cgi-bin/adm.cgi. id: CVE-2023-3380 info: name: WAVLINK WN579X3 - Remote Command Execution author: pussycat0x severity: critical description: | Remote Command Execution vulnerability in WAVLINK WN579X3 route...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

CVE-2026-44387

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-61376

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-59764

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-61376

CVE-2026-61376 affects ELECOM wireless LAN routers and access points. The flaw is an OS Command Injection in the Restore Settings function, allowing an attacker who can log in to the product to execute arbitrary OS commands. Connected documents confirm the vulnerability and generic impact (arbitr...

EUVD-2026-49726

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-61376

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-59764

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

EUVD-2026-49725

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-59764

Summary: CVE-2026-59764 affects ELECOM wireless LAN routers and access points. The issue is an OS command injection in the WebUI that enables an attacker who can log in to the product to execute arbitrary OS commands. The vulnerability is supported by multiple sources (NVD entries) with confirmed...

CVE-2026-44387

Summary (CVE-2026-44387): ELECOM wireless LAN routers and access points are affected by a reflected cross-site scripting vulnerability in the WebUI. Exploitation could allow an arbitrary script to run in a logged-in user’s browser. No exploitation details are provided in the connected documents b...

CVE-2026-44387

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

EUVD-2026-49724

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis...

CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis...

CVE-2026-12001 Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis...