MariaDB Connector/R2DBC prior to 1.4.1 hardcodes UTF-8 for all character encoding and decoding but fails to reject mid-session charset changes announced by the server via the OK-packet session-state-tracking mechanism. A hostile or man-in-the-middle server, or server-side constructs such as stored routines, triggers, or server configuration, can shift character_set_client to a non-UTF-8 encoding after connection initialization, causing the driver and server to interpret identical bytes under different encodings. This produces silent data corruption and a charset-confusion mismatch that can undermine byte-wise quoting and escaping, creating a pathway to SQL injection in applications that rely on driver-level escaping; no public exploit has been identified at time of analysis and the vendor-released patch is available in version 1.4.1.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Heap buffer overflow in the Linux kernel's Airoha (airoha_eth) network driver allows the packet-processing engine (PPE) flow-offload logic to write past an undersized allocation, corrupting kernel heap memory and crashing affected systems. The bug affects Linux 6.18.x through 6.18.39 and 6.19/7.x pre-release trees on hardware using the Airoha PPE flow-offload driver, and is triggered when airoha_ppe_foe_verify_entry() processes a flow hash at or above half the entry count. It is not in CISA KEV and has a low EPSS (0.18%), with no public exploit identified at time of analysis; impact is primarily denial of service.
Unauthenticated information exposure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the getWiFiApcliScan handler via /cgi-bin/cstecgi.cgi to force a wireless scan and read back AP-client scan results without any credentials. The flaw is an incorrect access-control (CWE-284) gap: the CGI endpoint does not verify authentication before executing the scan. No public exploit is identified and EPSS is low (0.18%), though SSVC rates the action as automatable with total technical impact per CISA's framework.
Use-after-free in the Linux kernel's VXLAN transmit path (vxlan_xmit) lets a stale Ethernet header pointer be dereferenced after route_shortcircuit() calls pskb_may_pull() and reallocates skb->head, corrupting or reading freed memory when accessing eth->h_dest. The flaw affects systems using a VXLAN overlay interface and is most realistically a denial-of-service (kernel crash) with potential information disclosure; no public exploit identified at time of analysis and EPSS is low (0.18%). It is not listed in CISA KEV and no proof-of-concept is known.
Memory corruption in the Linux kernel's net/sched fq_codel queueing discipline lets a local actor with traffic-control privileges trigger a wild kernel memory access and crash. When fq_codel drops packets during a peek operation, it calls qdisc_tree_reduce_backlog before restoring qlen; if qlen momentarily hits zero while peek still holds an skb, the parent class (e.g. qfq) is wrongly deactivated, producing a general-protection fault against a poisoned list pointer (0xdead000000000100 range) as seen under KASAN. No public exploit identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) distributed ARP table (DAT) code lets an attacker on the same mesh corrupt kernel memory: batadv_get_vid() calls pskb_may_pull(), which can reallocate the skb buffer, leaving the previously-cached ARP hardware-source pointer dangling and later dereferenced. The flaw affects systems running batman-adv mesh networking across numerous stable kernel branches; a vendor fix reorders the pointer acquisition to occur after the realloc. No public exploit is identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not on CISA KEV.
HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. DELETE, PUT) before routing, so a proxy that only permits POST is fooled while the gateway dispatches to a restricted handler. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the upstream fix is confirmed via commit 72123cd4.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the administrative account username by sending a crafted POST request to the getPasswordCfg handler of /cgi-bin/cstecgi.cgi. The flaw is reported by MITRE with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile); it is not listed in CISA KEV. Although scored CVSS 9.8, the concrete impact is limited to leaking the admin username, which is best treated as reconnaissance that lowers the effort of a subsequent password-guessing or credential attack.
Unauthenticated denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force an arbitrary device reboot by publishing a crafted MQTT message that reaches the internal startSlaveReboot handler, which performs no access-control check. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile). The impact is loss of availability rather than the code execution or data theft implied by the assigned CVSS 9.8.
Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
Denial of service in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver: mtk_poll_controller() passed a net_device pointer to mtk_handle_irq_rx(), which expects a struct mtk_eth pointer (the value registered as the request_irq cookie). When CONFIG_NET_POLL_CONTROLLER is enabled and the ndo_poll_controller path is exercised (e.g. via netconsole/netpoll), the resulting bad-pointer dereference crashes the kernel. Only devices using the MediaTek SoC Ethernet driver are affected; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's IPVS (IP Virtual Server) connection-synchronization path allows corruption of the connection hash table on backup directors running the IPVS sync daemon. When a synced connection is bound to a destination that carries the IP_VS_CONN_F_ONE_PACKET flag, expiry logic wrongly skips unlinking the conn_tab node, leaving a stale hash entry pointing at a freed struct ip_vs_conn. There is no public exploit identified at time of analysis and EPSS is very low (0.16%), so despite the auto-assigned 9.8 rating this is a memory-safety defect in a specialized load-balancing feature rather than a broadly weaponizable RCE.
Out-of-bounds kernel memory reads in the Linux kernel's NTFS driver arise because ntfs_read_locked_inode() copies a resident $ATTRIBUTE_LIST into ni->attr_list via a plain memcpy() with no sanity checking, while only the non-resident path was ever validated by load_attribute_list(). A crafted NTFS volume with a malformed resident attribute list is then trusted by every subsequent walk (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()), which read fixed-header fields past the buffer. The fix factors per-entry validation into ntfs_attr_list_entry_is_valid()/ntfs_attr_list_is_valid() and applies it on the resident path and inside load_attribute_list() itself; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).
Out-of-bounds slab read in the Linux kernel's legacy in-kernel NTFS driver lets a crafted on-disk $ATTRIBUTE_LIST leak or crash adjacent kernel heap memory when a malicious NTFS volume is mounted and read. The flaw is in ntfs_external_attr_find(), where a look-ahead attribute-list entry is dereferenced past the end of the kvmalloc'd buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.15%, 5th percentile), and it is not listed in CISA KEV.
Use-after-free / stale-pointer race in the Linux kernel netfilter nf_conntrack_expect subsystem was resolved by replacing the per-expectation timer API with the conntrack garbage-collection worker. Under the old timer scheme, expectation removal could lose a race with an expiring timer (timer_del() returning false), leaving an expectation referencing an already-released exp->master conntrack, enabling stale-pointer access. The issue affects systems using connection-tracking helpers/expectations (e.g. FTP, SIP, or nft_ct expectations); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.15% (5th percentile).
Out-of-bounds stack read in the Linux kernel's netfilter flowtable (nf_flow_table / nft_dev_forward_path) affects the bridge VLAN-untag fast path, where a u8 num_encaps counter can underflow from 0 to 255 and cause the kernel to walk a fixed 2-entry encap[] array far past its bounds. Affected are kernels from 5.13 onward that use netfilter flowtable offload over bridge devices; the flaw leaks adjacent kernel stack memory into a route descriptor and copies a bogus encap count. No public exploit is identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV.
Metadata corruption in the Linux kernel's lightweight tunnel (LWT) subsystem affects forwarded packets that carry XDP/TC skb metadata when they pass through LWT encapsulation (seg6, rpl, ila, mpls, ioam6, or BPF LWT xmit). Because encapsulation prepends outer headers over the skb headroom where metadata lives, non-BPF encaps silently overwrite it while BPF LWT xmit triggers a skb_data_move() WARNING and clears it; the fix drops metadata at the three LWT dispatch chokepoints before handing the skb to the encap op. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and the nominal CVSS 9.8 appears substantially overstated for what is fundamentally a kernel data-path robustness fix.
Unauthenticated OS command injection in Green-Computing NUMail lets remote attackers execute arbitrary operating-system commands on the underlying mail server host. The CVSS 4.0 score of 9.3 reflects network reach with no privileges or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth access and command execution makes it a high-priority patch target.
Stored XSS in the silverstripe/versioned package allows a CMS user with content-creation rights to execute arbitrary JavaScript in an administrator's browser by embedding a malicious payload in a page title that is rendered without escaping during the ArchiveAdmin restore workflow. All versions prior to 3.2.1 are affected. No active exploitation or standalone public exploit has been identified, though the patch PR includes working test payloads confirming the mechanism.
Command injection in JS Recon (js-recon) versions 1.2.1-beta.1 through 1.3.1-beta.2 lets anyone who opens a pull request run arbitrary commands on the project's GitHub Actions runner. The vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) interpolates the attacker-controlled branch name and fork repository name into a shell 'gh pr comment' command without sanitization. No public exploit is identified at time of analysis and it is not in CISA KEV, but the flaw is trivially reachable by external contributors and executes with the workflow's write-capable GITHUB_TOKEN.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Unauthenticated remote code execution in SOY CMS arises from unsafe deserialization of attacker-controlled data (CWE-502), letting a remote attacker run arbitrary code with the privileges of the web server process. The flaw was coordinated through JPCERT/CC and JVN (JVN04485476) and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the deserialization root cause and network-reachable, no-authentication vector make it high priority.
Authentication bypass in Redpanda through version 26.2.2 exposes the cluster Admin API on 0.0.0.0:9644 with admin_api_require_auth defaulting to false, so any request reaching that port is silently treated as a superuser. Unauthenticated network attackers can create and delete broker accounts, rewrite cluster configuration, and disrupt partition replication, giving them full administrative control of the streaming platform. Rated CVSS 4.0 9.3 (Critical); no public exploit or active exploitation has been identified at time of analysis.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Authorization bypass in Vikunja's project duplication API allows any authenticated user to inject an attacker-owned project into any other user's or team's project hierarchy without write access to the target parent. Affected versions span v0.21.0 through v2.3.0 - the entire post-namespace-migration release history - and exploitation requires only a single authenticated API call with no special configuration. No public exploit exists beyond the proof of concept published in the vendor advisory, and the CVE is not listed in the CISA KEV catalog; however, the trivial reproducibility and lack of rate-limiting or secondary authorization checks on the duplicate route make this a meaningful risk on any shared Vikunja instance.
Heap and integer-overflow memory corruption in the Linux kernel's userspace perf tool (perf sched) lets a malicious perf.data file corrupt memory when parsed by register_pid(). An analyst who runs 'perf sched' against an attacker-supplied perf.data trace can trigger out-of-bounds heap writes, an unchecked strcpy into a 20-byte comm buffer, and denial of service, potentially leading to code execution in the context of the user running perf. A vendor fix is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.
Denial-of-service in the Linux kernel's KVM subsystem on IBM Z (s390) mainframes stems from an unchecked airq_iv_create() return value in the zPCI adaptive-interrupt path. When AIBV allocation fails, zdev->aibv is left NULL and later dereferenced in kvm_zpci_set_airq(), crashing the host kernel. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.17% (7th percentile), consistent with a hard-to-trigger, resource-exhaustion-dependent bug rather than a broadly weaponizable flaw.
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote attackers to place files at any server filesystem location by supplying unsanitized path values in HTTP requests. The plugin uses attacker-controlled input directly to construct cache file paths, enabling traversal outside the intended cache directory. A publicly available proof-of-concept exists; while SSVC confirms no exploitation at time of analysis, the automatable attack vector and CWE-434 classification raise concern that the primitive could be chained to remote code execution if attacker-controlled content reaches a web-accessible directory.
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. A publicly available proof-of-concept exploit exists, reported by WPScan, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Out-of-bounds slab write in the Linux kernel idpf network driver lets a malicious or compromised control plane (a PF or a hypervisor's device model) corrupt kernel heap memory during interrupt-vector setup. idpf_get_reg_intr_vecs() fills the reg_vals[] array bounded only by per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply, which is never reconciled against the smaller num_allocated_vectors used to size the allocation, so a reply whose chunk counts sum higher writes struct idpf_vec_regs entries past the buffer. It carries a CVSS of 9.3, but EPSS is only 0.15%, it is not on CISA KEV, and there is no public exploit identified at time of analysis.
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authorization bypass in Eclipse Lyo 2.0.0 through 7.0.0 lets remote attackers abuse the 2-legged OAuth flow to promote a self-registered 'provisional' trusted client into a fully trusted one without the required administrator approval. Applications that build their authorization filters on Lyo's AbstractAdapterCredentialsFilter are affected, allowing an attacker to act as a trusted OAuth client and access protected OSLC resources. No public exploit identified at time of analysis, and it is not listed in CISA KEV; fixes shipped in 6.0.1.Final and 7.0.0.Beta3.
Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap read in the Linux kernel's perf userspace tooling (perf tools) lets a crafted perf.data file trigger memory disclosure or a crash when parsed. The flaw sits in machine__resolve(), which trusts an attacker-controlled CPU index (al->cpu) from sample data and indexes env->cpu[] without validating it against env->nr_cpus_avail; a large index reads past the heap allocation, and values like 65536 truncate to int16_t and silently resolve to CPU 0. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
Out-of-bounds read in the Linux kernel's netfilter nf_conntrack_irc connection-tracking helper (parse_dcc) allows a one-byte stale read past the IRC DCC parse buffer, potentially producing an incorrect DCC IP or port in the resulting conntrack expectation. The flaw stems from parse_dcc() treating data_end as an inclusive pointer while its caller passes an exclusive one-past-the-end limit; the read currently cannot fault because irc_buffer is over-allocated by one byte and datalen is capped at MAX_SEARCH_SIZE. It affects only systems with the nf_conntrack_irc helper active, and there is no public exploit identified at time of analysis (not in CISA KEV; EPSS 0.18%).
Unauthenticated WPS PIN generation and disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force the device to mint a new WiFi Protected Setup PIN and read it back by POSTing to the getGenerateWiFiWpsPin handler of /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any network-reachable attacker can obtain a valid WPS PIN and use it to join the wireless network. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the flaw is machine-automatable and requires no credentials.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's parental-control rules by sending a crafted POST request to the getParentalRules handler on /cgi-bin/cstecgi.cgi. The endpoint lacks any access-control check, so no credentials are required. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read the device's NTP configuration and current system time by sending a crafted POST request to /cgi-bin/cstecgi.cgi and invoking the getNtpCfg handler, which performs no access-control check. No public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest despite the high advertised CVSS. The leaked data is low-sensitivity, so real-world impact is far smaller than the 9.1 score suggests.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read the device's Wi-Fi ACL (MAC access-control) rules by sending a crafted POST request to the getWiFiAclRules handler in /cgi-bin/cstecgi.cgi. The CVSS vector marks it PR:N so no credentials are required, and no public exploit is identified at time of analysis; EPSS is low at 0.18% (7th percentile), indicating limited near-term exploitation likelihood.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's IP and port filtering rules by sending a crafted POST request to the getIpPortFilterRules handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), exposing firewall/filter configuration to anyone who can reach the web interface. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile).