Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.
Unauthenticated WPS PIN generation and disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force the device to mint a new WiFi Protected Setup PIN and read it back by POSTing to the getGenerateWiFiWpsPin handler of /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any network-reachable attacker can obtain a valid WPS PIN and use it to join the wireless network. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the flaw is machine-automatable and requires no credentials.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read diagnostic configuration and stored ping-log contents by sending a crafted POST request to the getDiagnosisCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no authentication check (CWE-284), so any network-reachable attacker can retrieve the data. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV, though CISA SSVC rates it as automatable with total technical impact.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's IP and port filtering rules by sending a crafted POST request to the getIpPortFilterRules handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), exposing firewall/filter configuration to anyone who can reach the web interface. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
Configuration disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers read the device's syslog configuration by sending a crafted POST request to the getSyslogCfg handler of /cgi-bin/cstecgi.cgi. The affected CGI endpoint fails to enforce authentication (CWE-284), so any actor with network reachability to the web interface can retrieve logging settings. No public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the CVE is not in CISA KEV.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's WPS configuration - including the active WPS PIN - by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the getWiFiWpsCfg handler performs no access-control check, any party who can reach the web interface can harvest the PIN and use it to derive the Wi-Fi passphrase and join the network. No public exploit identified at time of analysis and EPSS is low (0.18%), but the trivial, network-reachable nature of the flaw makes it high-value against exposed devices.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read the device's Wi-Fi ACL (MAC access-control) rules by sending a crafted POST request to the getWiFiAclRules handler in /cgi-bin/cstecgi.cgi. The CVSS vector marks it PR:N so no credentials are required, and no public exploit is identified at time of analysis; EPSS is low at 0.18% (7th percentile), indicating limited near-term exploitation likelihood.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read the device's NTP configuration and current system time by sending a crafted POST request to /cgi-bin/cstecgi.cgi and invoking the getNtpCfg handler, which performs no access-control check. No public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest despite the high advertised CVSS. The leaked data is low-sensitivity, so real-world impact is far smaller than the 9.1 score suggests.
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap buffer overflow in U-Boot's do_mv shell command (fs/fs.c) affects all versions through v2026.01-rc4 and allows an attacker with U-Boot shell access to corrupt pre-boot heap memory and potentially execute arbitrary code before any OS-level security controls activate. The flaw is rooted in missing bounds checks during string length addition when constructing move-command path arguments: integer overflow causes a heap under-allocation, which is then overflowed by an unchecked strcpy() call. No public exploit code or active exploitation has been identified, and the upstream fix is confirmed in v2026.04-rc1.