Unauthenticated privilege escalation to full site takeover in the AI Copilot - Content Generator plugin for WordPress (all versions through 1.5.6) lets remote attackers create an administrator account by saving and executing a malicious workflow whose wp_create_user action node specifies role=administrator. The plugin's only authorization barrier is a waic-nonce that is publicly emitted into frontend JavaScript (WAIC_DATA.waicNonce) on any page rendering the [aiwu-form] shortcode or public chatbot, so the nonce check provides no real protection. Reported by Wordfence with CVSS 9.8; no public exploit identified at time of analysis, but exploitation is trivial once the shortcode or chatbot is on a public page.
Out-of-bounds kernel memory reads in the Linux kernel's libceph client (decode_lockers() in net/ceph/cls_lock_client.c) let a malicious or compromised Ceph OSD trigger slab-out-of-bounds reads on any kernel client that issues the lock.get_info RADOS class method, such as during RBD exclusive-lock acquisition. A crafted reply with struct_len=0 causes a bare ceph_decode_32() to read 4 bytes past the validated buffer (feeding a garbage locker count into allocation), and a crafted num_lockers lets a subsequent bare ceph_decode_8() read one byte past the end, giving the OSD direct influence over the returned lock-type discriminator. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile); the issue is a memory-safety information-leak/DoS rather than the remote code execution implied by the CNA's 9.8 rating.
OS command injection in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware before 1.1.5_C1_202607071108) lets a remote, unauthenticated attacker inject shell commands through the localPin parameter of the /boafrm/formWsc (WPS) endpoint, yielding command execution as root. The flaw carries a CVSS 4.0 score of 9.3 and was reported by VulnCheck; a vendor patch exists (SAP10512), but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary commands as root by injecting shell metacharacters into the tunnelid and sessionid parameters of the /boafrm/formL2tpv3ConfigSetup web interface. The flaw was reported by VulnCheck and a vendor patch is available (D-Link SAP10512); no public exploit identified at time of analysis. The CVSS 4.0 vector rates it 9.3 with full confidentiality, integrity, and availability impact on the router.
Remote OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets an attacker execute arbitrary commands as root by supplying shell metacharacters in the ntpServerIp1 parameter of the /boafrm/formNtp web interface. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication and no user interaction, yielding full compromise (VC:H/VI:H/VA:H). No public exploit was identified at time of analysis, and it is not listed in CISA KEV; a vendor firmware patch is available.
Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the oldPIn parameter of the /boafrm/formPinManageSetup web endpoint. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device takeover. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.
Command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary OS commands as root by injecting into the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck.
Unauthenticated remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to run arbitrary commands as root by injecting into the action_value parameter of the /boafrm/formSmsManage web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device compromise. No public exploit identified at time of analysis, but a vendor patch is available.
OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets a remote attacker execute arbitrary commands as root through the /boafrm/formUSSDSetup web interface. Unsanitized input in the ussdValue and selectMenuValue parameters is passed to a shell, giving full device takeover with high confidentiality, integrity, and availability impact (CVSS 4.0 9.3). Reported by VulnCheck; no public exploit identified at time of analysis, and a vendor patch is available.
Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting into the host field of the /boafrm/formDebugDiagnosticRun diagnostic interface. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it gives full device takeover with no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not currently listed in CISA KEV.
Remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware version C1, firmware before 1.1.5_C1_202607071108) allows unauthenticated attackers to run arbitrary OS commands as root by injecting into the host and ipVer parameters of the /boafrm/formTracerouteDiagnosticRun web interface. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not in CISA KEV, but a vendor patch has been released and the finding was reported by VulnCheck.
Remote command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) lets unauthenticated attackers run arbitrary OS commands as root by abusing the host parameter of the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint. The CVSS 4.0 base score is 9.3 (critical) with a fully remote, no-privilege, no-interaction vector, giving complete device takeover. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the trivially exploitable vector and VulnCheck reporting make this a high-priority patch.
Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the fota_url parameter of the /boafrm/formLtefotaUpgradeFibocom endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is reachable over the network with no authentication or user interaction, yielding full high-impact compromise (VC:H/VI:H/VA:H). Reported by VulnCheck with a vendor patch now available; no public exploit identified at time of analysis.
Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting shell metacharacters into the fota_url parameter of the /boafrm/formLtefotaUpgradeQuectel web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw yields full device takeover with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability makes it a strong candidate for weaponization.
OS command injection in the D-Link DWR-M961 4G LTE router (hardware C1, firmware 1.1.2_C1_202602110044) lets a remote attacker inject arbitrary shell commands through the netDig.ping.dst parameter of the app.cgi diagnostic interface, yielding command execution as root. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; a vendor patch is available (SAP10512), and no public exploit has been identified at time of analysis.
Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root through the wps.cgi endpoint. The pin2g, pin5g, and pin6g WPS PIN parameters are passed to a shell without sanitization (CWE-78), giving full device takeover. Rated CVSS 4.0 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through the router's macfilter function and gain root on the device. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege, no-interaction exploitation with full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis, though the low-complexity, unauthenticated nature makes weaponization straightforward.
Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject OS commands through the TelnetSSH function that handles SSH configuration, yielding root-level control of the device. The flaw is a CWE-78 OS command injection tied to unsanitized input reaching a shell context; MSI has released a firmware fix and the issue was reported by VulnCheck. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects full compromise of the underlying system.
Remote code execution in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets unauthenticated network attackers inject arbitrary OS commands via the porTrigger function, reachable through the alg function, and obtain root on the device. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact), reflecting trivial network exploitation. The flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root by abusing the portFw port-forwarding function, reachable through the alg handler. The flaw was reported by VulnCheck and carries a critical CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available per the MSI support advisory.
OS command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) allows remote attackers to inject and execute arbitrary shell commands via the router's 'alg' (application-layer gateway) function, yielding full root privileges on the device. The CVSS 4.0 base score is 9.3 (Critical) with a fully remote, unauthenticated, low-complexity vector, and a vendor patch is available; however, no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in the MSI Radix AXE6600 tri-band Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's dmz configuration function, inject shell metacharacters, and execute arbitrary commands as root on the underlying Linux system. The flaw was reported by VulnCheck and carries a vendor CVSS 4.0 base score of 9.3 (VC:H/VI:H/VA:H), reflecting complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but a vendor firmware update is available.
Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's 'accesscontrol' function and run arbitrary OS commands, yielding full root control of the underlying Linux system. The published CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates unauthenticated network-facing exploitation, and the flaw was reported by VulnCheck, which has published a dedicated advisory. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets network-reachable attackers inject arbitrary OS commands through the router's urlfilter function and gain root on the device. The flaw (CWE-78) is unauthenticated per the CVSS 4.0 vector and was reported by VulnCheck; no public exploit identified at time of analysis, though full device takeover is the demonstrated impact. A vendor patch is available per the MSI support advisory.
Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.
Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.