CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

CVE-2026-67827

ZLMediaKit (commit 9fd5152) is affected by an Incorrect Access Control vulnerability in its HTTP API module . A remote, unauthenticated attacker can exploit the setServerConfig API endpoint to overwrite the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are then...

CVE-2025-11120 Tenda AC8 SetServerConfig formSetServerConfig buffer overflow

A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the publi...

CVE-2025-11120

CVE-2025-11120 affects Tenda AC8 with firmware 16.03.34.06. The vulnerability is in the formSetServerConfig function of /goform/SetServerConfig, where input boundary checking is insufficient, enabling a remote buffer overflow. An exploit has been publicly disclosed. Multiple feeds confirm the iss...