A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Path traversal in Comodo Internet Security Premium 12.3.4.8162 allows remote attackers to read or modify files via manipulation of file name/folder arguments in the File Name Handler component. Publicly available exploit code exists, but the attack complexity is high and exploitation probability is low (EPSS 0.29%). No vendor patch is available; the vendor did not respond to the disclosure.
Authentication bypass in bluebell-plus 2.x allows remote attackers to forge JWT tokens and gain unauthorized access by exploiting a hardcoded signing secret.
Remote command injection in Belkin F9K1122 firmware version 1.00.33 allows authenticated low-privilege attackers to execute arbitrary OS commands via the /goform/mp endpoint. The vulnerability is publicly disclosed with a proof-of-concept exploit available, but no vendor patch exists. Despite a critical classification, the low-impact CVSS 4.0 vector and moderate EPSS score (1.08%, 78th percentile) indicate limited immediate risk—priority is warranted only if the device is internet-exposed and using weak credentials.
OS command injection in Belkin F9K1122 firmware version 1.00.33 allows remote authenticated attackers to execute arbitrary commands on the device. The vulnerability resides in the formBSSetSitesurvey function of the web server, accessible at /goform/formBSSetSitesurvey, where parameters like wan_ipaddr, wan_gateway, and wl_ssid are passed unsanitized to a system command. Public proof-of-concept exploit code is available, but the vendor has not responded to disclosure and no patch is available; though the CVSS 4.0 base score is Low (2.1), the EPSS probability of exploitation is moderate at 1.08% (78th percentile).
OS command injection in Belkin F9K1122 firmware 1.00.33 allows remote authenticated attackers to execute arbitrary commands on the device via the WAN static IP configuration endpoint. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed. The vendor was contacted but did not respond, and no patch has been released.
A security vulnerability in BlackVue Dashcam 590X (CVSS 5.4). Risk factors: public PoC available.
Unrestricted file upload in BlackVue DR590X dashcam firmware allows unauthenticated attackers on the local network to upload arbitrary files via the /upload.cgi HTTP endpoint, achieving full device compromise. A public proof-of-concept exploit is available, but the vendor has not responded or released a patch. The low EPSS score (0.06%) and absence from CISA KEV suggest limited real-world exploitation so far.
Cross-site request forgery in 07FLYCMS (also sold as 07FLY-CMS and 07FlyCRM) up to version 1.3.9 allows remote attackers to trick authenticated users into submitting unwanted requests. This can lead to limited data tampering, such as modifying application settings, because the application lacks proper anti-CSRF protections. A public proof-of-concept is available, but no active exploitation has been confirmed by CISA KEV.
JWT token forgery in Done-0 Jank (all rolling-release builds up to commit 322caebbad10568460364b9667aa62c3080bfc17) allows remote attackers to authenticate without valid credentials by using hardcoded signing secrets ('jank-blog-secret' and 'jank-blog-refresh-secret'). Exploit code is publicly available but active exploitation is not confirmed; EPSS (0.04%) and low CVSS indicate limited real-world risk.