cve-2025-50428

CVE-2025-50428 - RaspAP コマンドインジェクション CVE-2025-50428 の概念実証エクスプロイトです。RaspAP の raspap-webgui 3.2.9 以前に存在するコマンドインジェクションの脆弱性を悪用します。 脆弱性 ID| CVE-2025-50428 ---|--- 深刻度| 高 CVSS 3.1: 8.6 CVSS ベクター| CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 脆弱性タイプ| コードインジェクション 攻撃経路| リモート（認証済み） 必要な権限|...

CVE-2026-101858

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101860

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101860 RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

EUVD-2026-88604

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101859

A vulnerability exists in RaspAP raspap-webgui up to version 3.5.5 within the OpenVPN Configuration Handler component. The root cause is an os command injection vulnerability in the escapeshellcmd function of the ajax/openvpn/del_ovpncfg.php file. Attackers can exploit this by manipulating the cf...

EUVD-2026-88603

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

EUVD-2026-88601

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101858

A flaw in RaspAP raspap-webgui versions up to 3.5.5 allows for OS command injection . The vulnerability exists within the SSID Processing component, specifically in the WiFiManager::writeWpaSupplicant function located in the file src/RaspAP/Networking/Hotspot/WiFiManager.php. Attackers can achiev...

CVE-2026-101859: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-16876

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...

EUVD-2026-72188

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...

CVE-2026-16876

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...

CVE-2026-16876

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...

CVE-2026-16876

NEC UNIVERGE IX-R/IX-V series routers are affected by an authentication bypass in the WebGUI component, classified as Missing Authentication for Critical Function (CWE-306) . A remote unauthenticated attacker can send a specially crafted message to the WebGUI over the internet to execute arbitrar...

CVE-2026-16876: Missing Authentication for Critical Function

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...