CVE-2026-71913

Multiple DrayTek VigorAP models contain a command injection vulnerability in the uploadsettings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input...

CVE-2026-71913 DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi

Multiple DrayTek VigorAP models contain a command injection vulnerability in the uploadsettings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input...

CVE-2026-71913

Multiple DrayTek VigorAP models are affected by an OS command injection vulnerability in the upload_settings.cgi interface. The root cause is insufficient filtering of the restorekey field before it is concatenated into a shell command, allowing a remote attacker with valid administrative credent...

EUVD-2026-64972

Multiple DrayTek VigorAP models contain a command injection vulnerability in the uploadsettings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input...

The vulnerabilities of the components ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi of the D-Link DIR-823G router’s microprogramming system allow a hacker to execute arbitrary code.

The vulnerability of the ExportSettings.sh, uploadsettings.cgi, GetDownLoadSyslog.sh, and uploadfirmware.cgi components of the D-Link DIR-823G router’s microprogramming system is related to the possibility of bypassing authentication. Exploiting this vulnerability allows a malicious actor to...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

Code injection

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...