OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers execute arbitrary shell commands by injecting into the admpass argument of the setLoginPasswordCfg function in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input to a system shell without sanitization, granting full device compromise. Publicly available exploit code exists (disclosed via VulDB/GitHub); no active exploitation is confirmed in CISA KEV, and EPSS is modest at 0.89% (76th percentile).
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary system commands by manipulating the tty_server argument passed to the setAdvancedInfoShow function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation yielding full confidentiality, integrity, and availability impact. EPSS is currently low (0.89%, 76th percentile) and there is no public exploit identified as being actively used in the wild per CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sys_info argument passed to the setMiniuiHomeInfoShow function of /cgi-bin/cstecgi.cgi. Per the CVSS vector the attack is network-based with no privileges or user interaction required (PR:N/UI:N), and publicly available exploit code exists (published via VulDB/GitHub), though it is not listed in CISA KEV. EPSS is low at 0.89% (76th percentile), suggesting exploitation is plausible but not yet widespread.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to inject arbitrary operating-system commands through the telnet_enabled argument of the setTelnetCfg function in /cgi-bin/cstecgi.cgi. The flaw carries a CVSS 4.0 score of 8.9 with high impact to confidentiality, integrity, and availability, and publicly available exploit code exists, though it is not listed in CISA KEV. EPSS is modest at 0.89% (76th percentile), indicating publicly available exploit code exists but no confirmation of widespread active exploitation.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the HTTP argument processed by the CsteSystem function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists and a POC has been disclosed; there is no public exploit identified as actively exploited in the wild (not on CISA KEV), and EPSS is low at 0.89%.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote, unauthenticated attackers execute arbitrary shell commands by manipulating the 'mode' parameter passed to the setWiFiAclRules function in the /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists (VulDB) and SSVC rates it automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV. With CVSS 4.0 of 8.9 and no authentication required, any attacker reaching the device's web interface can gain full control.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote unauthenticated attackers execute arbitrary system commands by manipulating the 'tz' parameter of the setNtpCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, total impact) reflects unauthenticated network reachability with full compromise, though EPSS remains modest at 0.89%. This is no public exploit identified as actively exploited - there is no CISA KEV listing at time of analysis.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sambaEnabled argument passed to the setStorageCfg function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) with total impact on confidentiality, integrity, and availability. Publicly available exploit code exists (VulDB), though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers inject arbitrary operating-system commands through the wanIdx argument of the setDmzCfg handler in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input into a shell context without sanitization, yielding full command execution on the device. Publicly available exploit code exists and the SSVC framework rates technical impact as total and the attack as automatable, though it is not listed in CISA KEV and EPSS remains modest at 0.89%.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'merge' parameter in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new2), enabling trivial exploitation against internet-facing devices. CVSS 8.9 reflects network attack vector with no authentication required (AV:N/PR:N), and EPSS data suggests moderate real-world exploitation probability given the POC availability and low attack complexity.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via crafted addrPrefixLen parameter to the setIpv6LanCfg function in /cgi-bin/cstecgi.cgi. CVSS 8.9 (High) with CVSS:4.0 vector indicating network-accessible, low-complexity attack requiring no privileges or user interaction. Publicly available exploit code exists (GitHub POC), enabling weaponization by threat actors. Not currently listed in CISA KEV, suggesting limited observed exploitation despite public disclosure and high severity scoring.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the setIptvCfg parameter in /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with network attack vector and no authentication required. Public exploit code available on GitHub since disclosure, significantly lowering exploitation barrier for attackers targeting internet-facing consumer routers. No vendor patch identified for this end-of-life device at time of analysis.
Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoStream-based remote aggregation repository reads objects from an Infinispan cache using java.io.ObjectInputStream with no ObjectInputFilter applied. Any attacker able to write to the backing Infinispan cache can plant a malicious serialized gadget that executes in the application context during routine get/recover operations. Publicly available exploit code exists, though EPSS is low (0.08%) and there is no evidence of active exploitation.
Unsafe Java deserialization in the Apache Camel camel-mina component (versions 3.0.0 through 4.14.5, 4.15.0 through 4.18.1, and 4.19.0) allows remote attackers to achieve arbitrary code execution by delivering a crafted serialized object to a MINA TCP/UDP consumer that converts inbound data to ObjectInput. The flaw stems from MinaConverter.toObjectInput wrapping raw network bytes in an ObjectInputStream with no ObjectInputFilter or class allow-listing, so readObject() instantiates attacker-chosen classes. Publicly available exploit code exists and vendor patches are released, but there is no evidence of active exploitation (not in CISA KEV) and EPSS is very low at 0.08%.
Remote code execution in ProjeQtor 7.0 through 12.4.3 arises from a ZipSlip flaw in the plugin upload feature, where authenticated users holding upload permissions can smuggle directory-traversal sequences inside a crafted ZIP archive so that files extract outside the intended plugin directory. By planting a PHP webshell into a web-accessible path, an attacker executes arbitrary code with the web server's privileges. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as actively exploited in the wild, and EPSS is a modest 0.42% (62nd percentile).
Command injection in the Tenda HG3 2.0 gateway/router allows an authenticated remote attacker to inject arbitrary OS commands through the formTracert handler at /boaform/formTracert by manipulating the datasize argument (CWE-77). Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as being actively used in the wild and it is not listed in CISA KEV. EPSS is modest at 0.29% (52nd percentile), indicating exploitation is plausible but not yet widespread.
OS command injection in Tenda HG3 router version 2.0 (build 300003070) allows authenticated remote attackers to execute arbitrary system commands with router privileges via the fmgpon_loid parameter in the formgponConf administrative function. Public exploit code is available and confirmed usable for attacks per VulDB reporting, significantly lowering the skill barrier for exploitation despite requiring valid administrative credentials.
Stack-based buffer overflow in the Tenda HG3 2.0 router allows authenticated remote attackers to corrupt memory by supplying an oversized destNet parameter to the formUploadConfig handler at the /boaform/formIPv6Routing endpoint. Publicly available exploit code exists, though EPSS rates real-world exploitation probability very low (0.05%, 14th percentile) and there is no public exploit identified as actively exploited. Successful exploitation yields total impact to confidentiality, integrity, and availability, typically manifesting as device crash or arbitrary code execution on the embedded system.
Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to compromise the device via buffer overflow in the httpd web management interface. Exploitation requires low-privilege credentials but enables complete device takeover (CVSS 7.4). A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier to active exploitation despite requiring authentication.
Buffer overflow in Tenda F456 router firmware 1.0.0.5 allows authenticated remote attackers to achieve full device compromise through the PPTP user management interface. The vulnerability exists in the fromPPTPUserSetting function within the httpd component, exploitable via manipulation of the 'delno' parameter sent to /goform/PPTPUserSetting. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation, though no CISA KEV listing or widespread exploitation has been confirmed at time of analysis.
Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to compromise device integrity and confidentiality via buffer overflow in the WAN configuration interface. The vulnerability exploits the fromAdvSetWan function's improper handling of the wanmode parameter, enabling complete device takeover. Public exploit code exists on GitHub (Litengzheng/vuldb_new), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector, low complexity (AC:L), and publicly available POC makes this a realistic threat to exposed management interfaces.
Buffer overflow in Tenda F456 router version 1.0.0.5 allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromSetIpBind function of the httpd daemon's /goform/SetIpBind endpoint, exploitable via malformed 'page' parameter input. Public exploit code exists on GitHub (Litengzheng/vuldb_new), elevating real-world risk despite requiring low-privilege authentication (CVSS 7.4, EPSS data not provided, not in CISA KEV at time of analysis).
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
Arbitrary file disclosure in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to read .log files anywhere on the filesystem by injecting ../ sequences into the logname parameter of the dynamicDialog.php log viewer. Reported by VulnCheck with publicly available exploit code; EPSS is low (0.20%, 42th percentile) and it is not in CISA KEV, so no public exploit identified as actively exploited. The flaw is limited to files readable by the web server process and to .log-named targets, capping direct impact to information disclosure.
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' records - including password hashes and API keys - by directly calling the objectDetail.php endpoint, which fails to enforce ownership or role checks (CWE-862). Because the exposed administrator credentials enable privilege escalation, the flaw effectively promotes a low-privilege account to full control. Publicly available exploit code exists, though EPSS is low (0.06%, 18th percentile) and it is not on CISA KEV, indicating no public exploit identified as actively used in the wild.
Authorization bypass in Milesight AIOT network cameras stems from weak cryptographic key generation in specific firmware builds, letting an adjacent attacker defeat authentication controls and gain unauthorized access to camera functions. The affected line spans a broad catalog of Milesight IP camera and NVR models (MS-Cxx and MS-Nxxxx series). No public exploit identified at time of analysis; EPSS is negligible at 0.01% and CISA SSVC records no observed exploitation, so this is a disclosed-but-not-yet-exploited ICS/IoT issue.
OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating-system commands via the CsteSystem function in /cgi-bin/cstecgi.cgi. Attacker-controlled input passed through the CGI Handler's HTTP argument is concatenated into a system command without sanitization. Publicly available exploit code exists (SSVC exploitation status: poc); there is no public exploit identified as being used in active attacks, and EPSS is modest at 0.89% (76th percentile).
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'enable' parameter in the setUPnPCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (POC confirmed), increasing immediate risk for exposed devices. EPSS data not available, but CVSS 8.9 with network vector (AV:N), no authentication (PR:N), and low complexity (AC:L) indicates trivial remote exploitation against default configurations.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'wizard' parameter in the setWizardCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (CVSS E:P), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector (AV:N), no authentication (PR:N), low complexity (AC:L), and published POC indicates elevated real-world risk for internet-exposed devices.
Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize) lets an attacker who can write to the backing Consul KV store achieve arbitrary code execution inside the Camel process. Any deployment using a Consul-backed Camel registry on versions 3.0.0 up to 4.14.6 or 4.15.0 up to 4.18.1 is affected. There is no public exploit identified at time of analysis, EPSS is low (0.08%), and this is a missed instance of the same deserialization class fixed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding the built-in latepoint_agent role hijack any WordPress administrator account. The connect-customer-to-wp-user ability's execute() method performs no check that the target WP user ID is a privileged account, so an agent can bind a controlled LatePoint customer record to an admin's account and then trigger the standard customer password-reset flow to seize it. CVSS is 8.8; EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but the technical impact is total site takeover.
Authenticated attackers with Subscriber-level privileges can escalate to Administrator role in Highland Software Custom Role Manager for WordPress via profile update exploitation. The hscrm_save_user_roles() function lacks capability checks on the personal_options_update hook, allowing low-privilege users to modify arbitrary user roles including their own. Version 1.0.1 released with authorization fixes. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. EPSS data not provided, no CISA KEV listing identified, indicating limited widespread exploitation despite the severity of self-service privilege escalation to site administrator.
Cross-site request forgery in diskover-community (diskover) version 2.3.5 and earlier lets a remote attacker forge state-changing requests to public/settings_process.php, escalating privileges and exposing sensitive configuration data when an authenticated user is lured into triggering the request. The flaw carries a CVSS 8.8 rating and total technical impact per CISA SSVC, though publicly available exploit code exists rather than confirmed active exploitation, and the EPSS probability is very low (0.02%).
Local privilege escalation in the Fan Control (FanControl) desktop application V251 for Windows allows a low-privileged local user to gain administrator-level execution by abusing the application's Open File Dialog, which processes user-supplied paths under the app's elevated security context (CWE-269). Because Fan Control requires elevated permissions to access hardware sensors and fan controllers, an attacker who can interact with the running elevated instance can pivot from limited user rights to full SYSTEM/administrator control. There is no public exploit identified in the structured input, though a referenced GitHub gist likely contains a technical write-up; EPSS is very low (0.01%) and CISA SSVC lists exploitation status as none, indicating no observed in-the-wild activity.
Command injection in LogonTracer versions prior to 2.0.0 allows authenticated users to execute arbitrary OS commands on the server. LogonTracer, a JPCERT/CC-developed log analysis tool for investigating lateral movement in Windows Active Directory environments, contains an insufficiently sanitized input handler that permits shell command injection. Authentication is required (PR:L), but once logged in, attackers can achieve complete system compromise with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). No active exploitation confirmed at time of analysis, though the CVSS 4.0 score of 8.7 and low attack complexity (AC:L) indicate significant risk for organizations running vulnerable versions.
Buffer overflow in Moxa Secure Router's HTTPS management interface allows unauthenticated remote attackers to crash the web service via specially crafted requests with malformed length parameters. Exploitation causes denial-of-service requiring device reboot, with no confidentiality or integrity impact. CVSS 8.7 reflects high availability impact to the vulnerable component only. No public exploit code identified at time of analysis, and no evidence of active exploitation (not in CISA KEV).
Atom table exhaustion in plug_cowboy 2.0.0-2.8.0 allows remote denial of service via HTTP/2. Unauthenticated attackers can crash the Erlang VM by sending HTTP/2 requests with unique :scheme pseudo-header values, permanently filling the non-garbage-collected atom table until the system_limit is reached. Affects only HTTP/2 connections; HTTP/1.1 is not vulnerable. CVSS 8.7 (High) with network attack vector, low complexity, and no required privileges. No active exploitation confirmed (not in CISA KEV), but exploit is trivial given the publicly documented attack mechanism in the GitHub advisory.
Arbitrary code execution in AWS QnABot on AWS (versions 7.2.4 and earlier) allows an authenticated administrator to break out of the intended expression sandbox by abusing the static-eval npm package. By injecting a crafted conditional chaining expression through the Content Designer interface, an admin escapes the sandbox via JavaScript prototype manipulation and runs code inside the fulfillment Lambda, reaching backend resources not normally exposed. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%), consistent with the SSVC assessment that no exploitation has been observed.
Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
Arbitrary code execution in Apache Camel's PQC component (camel-pqc) arises because FileBasedKeyLifecycleManager deserializes `<keyId>.key` files with java.io.ObjectInputStream and no ObjectInputFilter or class allow-listing. Because the KeyPair cast happens only after readObject() returns, malicious gadget-chain side effects execute before any type check, letting an attacker who can plant a crafted serialized object in the key directory run code as the application. It affects Camel 4.19.0 before 4.20.0 and 4.18.0 before 4.18.2, carries CVSS 7.8, and has no public exploit identified at time of analysis; EPSS is very low at 0.07%.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows local attackers to crash the application or potentially execute arbitrary code through specially crafted PDF files with malformed form field hierarchies. The vulnerability triggers when parsing logic misidentifies non-signature data as valid signatures, causing invalid memory writes during internal data structure construction. User interaction is required to open the malicious PDF document. No active exploitation has been identified at time of analysis, though the local attack vector and high CVSS score (7.8) warrant attention for endpoint security in environments handling untrusted PDF files.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Buffer overflow in TH1520 AON firmware protocol driver allows local authenticated attackers with low privileges to execute arbitrary code and gain elevated system access. The vulnerability stems from unsafe pointer arithmetic when accessing the 'mode' field through the 'resource' pointer with unchecked offsets in the T-HEAD firmware driver. Patches available across stable kernel branches (6.18.23, 6.19.13, 7.0) with low EPSS score (0.02%) indicating minimal observed exploitation attempts, though CVSS 7.8 reflects high impact if exploited on affected T-HEAD TH1520 systems.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Sensitive data exposure in Templately WordPress plugin ≤3.6.1 allows authenticated attackers to retrieve embedded sensitive information via network requests. The vulnerability exhibits scope change (S:C) indicating potential cross-boundary impact, with high confidentiality impact but no integrity or availability effects. CVSS 7.7 severity driven by network accessibility and low attack complexity. No CISA KEV listing indicates no confirmed widespread exploitation. Reported by Patchstack's audit team with reference to their vulnerability database entry.
Timing attack against Spring Boot DevTools remote secret comparison allows adjacent network attackers to recover the shared secret and achieve remote code execution by uploading malicious classes. Affects Spring Boot 2.7.x through 4.0.x when DevTools remote feature is enabled. Attacker must be on same network segment (AV:A) and overcome high attack complexity (timing-based cryptographic weakness), but requires no authentication or user interaction. CVSS 7.5 severity reflects adjacent vector limitation; real-world risk depends heavily on whether DevTools remote restart is enabled in production (not recommended practice) and network segmentation. No confirmed active exploitation (not in CISA KEV). Vendor-released patches available across all affected branches.