zyxel-cve-2021-35036-super-admin-password-leak

CVE-2021-35036: Análisis de Filtración de Contraseña de Super-Admin de Zyxel Este repositorio contiene el informe público y los archivos de laboratorio para CVE-2021-35036. El problema fue reportado contra el firmware Zyxel VMG3625-T50B y se centró en las rutas getter de DAL que devolvían...

CVE-2026-2035703-x300

CVE-2026-2035703: Tozed ZLT X300 5G CPE — Remote Root Code Execution via SDR Rogue Base Station Status: Under coordinated disclosure 90-day embargo Discovered: 2026-08-08 Researcher: Muhammad Nadeem Danish danish1162 CVE ID: CVE-2026-2035703 Severity: Critical CVSS 9.8 CWE: CWE-78 OS Command...

f609-brute

f609-brute f609-brute is a simple brute force tool for Telkom Indonesia's ZTE F609 routers. Hence Telkom Indonesia implements TR-069 to ZTE F609 modems, they routinely update admin password. f609-brute is running on Python 2.7. Usage usage: python f609.py Example Usage python f609.py...

...[ More ]

Tozed ZLT X300 5G CPE Router firmware version 6.01.3 contains an OS command injection vulnerability in the TR-069/CWMP client daemon netcwmpd. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, which constructs a shell command executed via systembyroot as root. An attacker...

CVE-2025-9961

CVE-2025-9961 TP-Link AX10/AX1500 CWMP Desbordamiento de búfer RCE Descripción general Desbordamiento de búfer basado en pila en CWMP TR-069 que conduce a la ejecución remota de código. Campo| Valor ---|--- Producto| TP-Link AX10, AX1500 Afectados| AX10 B"Malicious ACS" B -- C"SetParameterValues"...

CVE-2026-15427

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069...

CVE-2026-15428 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...

CVE-2025-67113

OS command injection in the CWMP client /ftl/bin/cwmp of Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into t...

EUVD-2020-26921

Malware in sbrugna...

EUVD-2020-26920

Malware in sbrugna...

CVE-2020-5762

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of t...

CVE-2020-5761

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service...

CVE-2020-27692

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings responsible for managing devices remotely. This makes it possibl...

Cross site request forgery (csrf)

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings responsible for managing devices remotely. This makes it possibl...

CVE-2020-27692

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings responsible for managing devices remotely. This makes it possibl...

4 Unpatched Bugs Plague Grandstream ATAs for VoIP Users

UPDATE Multiple high-severity vulnerabilities in the Grandstream HT800 series of Analog Telephone Adaptors ATAs threaten home office and midrange users alike, with outages, eavesdropping and device takeover. The HT800 series of ATAs is designed for everyone from home or small-office users to...

CVE-2020-5762

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of t...

CVE-2020-5761

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service...

Null pointer dereference

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of t...

Code injection

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service...