Invalid pointer dereference in the Linux kernel's RapidIO TSI721 driver allows an unauthenticated attacker on an adjacent RapidIO network to crash the kernel or corrupt memory by sending a crafted doorbell message. The root cause is a logic error in tsi721_db_dpc(): the 'found' flag is not reset at the start of each list_for_each() iteration, causing every doorbell after the first match to be treated as found, and causing list-end traversal with an invalid iterator pointer when no match exists. No public exploit exists and EPSS is 0.18% (7th percentile), consistent with the highly constrained physical attack surface; patches are available across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem exposes adjacent-network attackers to kernel memory disclosure and system crash. The vulnerability exists in batadv_dat_get_vid() within the Distributed ARP Table (DAT) component, which calls batadv_get_vid() to access the proto field of an ethernet header without first verifying that the underlying data is accessible - an obligation other call sites fulfill but this path omits. A network-adjacent unauthenticated attacker can send a crafted Layer 2 frame to trigger the flaw, yielding High confidentiality impact (kernel memory disclosure) and High availability impact (kernel panic). EPSS is 0.18% (7th percentile) and the flaw is not in CISA KEV, indicating no public exploitation at time of analysis.
Lock mode mismatch in the Linux kernel's DRM XE GPU driver allows a local low-privileged user to trigger a kernel WARN_ON assertion via the xe_vm_bind_ioctl interface on systems compiled with the debug option CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y. The vulnerability arises because xe_pt_svm_userptr_pre_commit() acquires the SVM notifier_lock for read, but the injected test path calls into drm_gpusvm_unmap_pages() expecting a write-mode hold, causing the assertion to fire and potentially destabilizing the kernel. No public exploit has been identified and an EPSS of 0.18% (7th percentile) reflects minimal real-world threat, with impact confined entirely to debug kernel builds.
Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches.
Race condition in the Linux kernel's driver core `dev_has_sync_state()` exposes a TOCTOU (Time-of-Check Time-of-Use) flaw allowing local low-privileged users to potentially trigger kernel memory corruption, information disclosure, or a system crash. The function reads `dev->driver` twice without holding `device_lock()`, enabling a concurrent device unbind operation to clear the pointer between the NULL check and its subsequent dereference, resulting in use of a stale or NULL pointer in kernel context. No active exploitation has been identified (no CISA KEV listing, EPSS 0.18%), but the kernel-level impact class warrants prompt patching on affected stable branches.
Use-after-free and race condition vulnerabilities in the Linux kernel's tlclk (Telecom Clock) character driver expose local low-privileged users to potential kernel-space memory corruption, privilege escalation, or system crash. The module cleanup function tlclk_cleanup() frees alarm_events memory before awakening blocked waitqueue readers and before the switchover_timer completes, creating a use-after-free window during concurrent module unload. Additionally, the missing .owner field in file_operations allowed module unloading while userspace held the device open. No public exploit exists and EPSS is 0.18%, but patched kernel versions are confirmed across all active stable branches.
Use-after-free in the Linux kernel AppArmor subsystem's aa_replace_profiles function exposes kernelspace memory to corruption by a local low-privileged attacker. The defect arises from reading udata->size after aa_put_loaddata(udata) has released the reference - if that release triggers a free, the subsequent read constitutes a UAF that can be leveraged for privilege escalation or arbitrary kernel memory manipulation. EPSS sits at 0.18% (7th percentile) and no CISA KEV listing exists, indicating no confirmed widespread exploitation, though the local-access, low-complexity nature makes this a realistic intrahost threat on AppArmor-enabled systems.
Corrupted xattr entry handling in the Linux kernel's f2fs filesystem driver exposes local users to kernel memory disclosure and potential corruption. When f2fs_listxattr() processes a crafted or corrupted filesystem image containing malformed extended attribute entries that fall outside the valid xattr storage area, the kernel previously returned a partial success result without validating entry boundaries. This flaw affects a wide range of kernel stable branches from the commit introducing the bug (688078e7f36c293dae25b338ddc9e0a2790f6e06) through the backported fixes. No public exploit code exists and EPSS is 0.18% (7th percentile), indicating low exploitation probability at time of analysis.
Incorrect unit conversion in the RISC-V memory management subsystem causes vmemmap_start_pfn to be computed with a physically misaligned base, violating the mask-alignment requirement for compound_info encoding in the sparse memory model. Linux kernel versions incorporating commit 476849b0fba4 on RISC-V hardware where DRAM base is not aligned to MAX_FOLIO_NR_PAGES × PAGE_SIZE are affected - a condition confirmed on QEMU virt machines and potentially other RISC-V platforms. CVSS 7.8 (AV:L/PR:L/C:H/I:H/A:H) reflects potential local privilege escalation via kernel memory corruption; EPSS of 0.17% (7th percentile) and no CISA KEV listing indicate no observed exploitation activity. No public exploit is identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's ARM SCMI firmware subsystem allows a local low-privileged attacker on ARM-based hardware to trigger kernel memory corruption via the scmi_power_name_get() function, which fails to validate the domain number supplied by external callers. Affected kernel versions span from the introduction commit 76a6550990e2 through multiple stable branches, with patches backported to LTS lines 5.15, 6.1, 6.6, 6.12, and 6.18. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (7th percentile), indicating no current attacker tooling interest despite the 7.8 CVSS score.
Use-after-free in the Linux kernel's veth driver XDP error path allows a local attacker with network interface configuration privileges to corrupt kernel memory, potentially achieving privilege escalation. The flaw stems from an off-by-one error in the rollback loop during XDP enablement: when xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the loop skips netif_napi_del() for the failing queue index, leaving a dangling napi_struct in the device's napi_list. On subsequent device teardown, the freed - and potentially reallocated - queue memory is traversed via the stale NAPI list, resulting in UAF with full C/I/A impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS is 0.17% (7th percentile), reflecting low current exploitation probability.
Out-of-bounds read in the Linux kernel's ntfs3 LZNT decompression handler allows a local attacker with low privileges to trigger kernel memory access violations by mounting a specially crafted NTFS3 filesystem image. Affected stable branches span 5.15 through 7.x, with patched releases available across all branches. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low predicted exploitation probability despite the high CVSS score of 7.8.
Memory corruption in the Linux kernel's VMware graphics (vmwgfx) DRM driver allows a local, low-privileged user on a VMware guest system to corrupt MOB (Memory Object Buffer) allocation metadata, leading to out-of-bounds reads or writes with high confidentiality, integrity, and availability impact. A field-naming bug in vmwgfx_resource.c writes boolean literals (0/false and 1/true) to the guest_memory_size unsigned-long field instead of the adjacent guest_memory_dirty bitfield, causing subsequent size-dependent operations to compute zero-length or wrap-around memory ranges on the MOB bitmap. No public exploit has been identified at time of analysis; EPSS is very low at 0.17% (6th percentile), though the CVSS 7.8 score reflects meaningful severity if triggered locally on a VMware guest.
Out-of-bounds memory corruption in the Linux kernel's vmwgfx DRM driver (vmw_external_bo_copy()) allows a local attacker with low-privilege DRM access to corrupt kernel memory via a crafted atomic display commit using an imported dma-buf framebuffer. Two distinct code paths are vulnerable: the equal-stride memcpy path suffers unsigned integer underflow when caller-supplied offsets exceed the buffer object size, and the non-equal-stride row-by-row path performs no bounds validation at all, allowing the copy loop to walk arbitrarily past the vmap end. Vendor-released patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's ltc4282 hwmon driver exposes systems with this hardware monitor to kernel memory disclosure or destabilization via the VGPIO minimum alarm voltage sysfs read path. A missing return statement in the driver causes the kernel to access memory beyond intended bounds when a local user reads the VGPIO channel's minimum alarm voltage attribute. Patch versions are available across multiple stable branches; no public exploit exists and EPSS sits at 0.17% (6th percentile), indicating very low current exploitation pressure despite the 7.8 CVSS score.
Use-after-free in the Linux kernel's UFS (Universal Flash Storage) core tracing subsystem allows a local attacker with tracing access to trigger a kernel crash or potentially achieve privilege escalation. The UFS trace event infrastructure stores raw pointers to the `hba` (Host Bus Adapter) structure in the trace ring buffer, then dereferences those pointers inside `TP_printk()` when `/sys/kernel/tracing/trace` is read - which may occur long after the underlying UFS device has been detached and its memory freed. No public exploit has been identified at time of analysis, and EPSS is 0.17% (6th percentile), indicating low near-term exploitation probability despite the high CVSS score.
Race condition in the Linux kernel's ALSA OSS sequencer layer exposes local low-privilege attackers to kernel ring-buffer state corruption via unsynchronized reset operations. Specifically, snd_seq_oss_readq_clear() modifies qlen, head, and tail fields without holding q->lock, racing against reader and producer paths that correctly acquire the spinlock, potentially leaving stale or dropped MIDI events and corrupted readiness state. No public exploit identified at time of analysis; EPSS at 0.17% (6th percentile) indicates negligible current exploitation interest despite the CVSS 7.8 score reflecting theoretical kernel memory corruption severity.
Bitmap overflow and incorrect global accounting in the Linux kernel's percpu-km memory allocator (`mm/percpu-km`) allow a local low-privileged attacker on SMP/NUMA systems to corrupt kernel memory, with potential for privilege escalation or kernel crash. Two separate commits introduced the flaws: a63d4ac4ab609 caused `pcpu_create_chunk()` to write beyond the `chunk->populated` bitmap when `nr_units > 1`, and b539b87fed37f introduced the companion `pcpu_nr_empty_pop_pages` accounting error. Fixes have been backported to eight stable kernel branches (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2); no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel ALSA PCM subsystem allows a local low-privilege attacker to corrupt kernel memory by exploiting a race between snd_pcm_drain() and snd_pcm_unlink() on linked streams. When a drain wait terminates by signal or timeout while group membership is concurrently modified by an unlink, a stack-allocated wait queue entry is left queued on a freed peer stream's sleep list; a subsequent wake_up() call then dereferences that freed stack frame. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS of 0.16% (6th percentile) reflects low near-term exploitation probability.
Out-of-bounds read and write vulnerabilities in the Linux kernel's softing CAN driver `fw_parse()` function allow a local low-privileged attacker to corrupt kernel DPRAM memory by supplying a crafted firmware image. Affected kernels span from 2.6.38 through pre-patch stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2), with fixes backported across all active stable trees. No public exploit or active exploitation has been identified at time of analysis.
Heap out-of-bounds memory access in the Linux kernel s390/zcrypt subsystem exposes EP11 crypto card administrative paths to local low-privileged users. The flaw resides in the domain value upper-limit check processed when sending EP11 CPRBs (Control Program Request Blocks) through custom zcrypt device nodes - the missing AP_DOMAINS (256) ceiling allows an attacker-supplied domain index to reach heap memory beyond the `perms->adm` structure. No public exploit code has been identified and this is not listed in CISA KEV, but the CVSS 7.8 local vector and confirmed multi-version patch backports across stable kernel branches indicate the Linux security team treats the impact as high. EPSS at 0.16% (6th percentile) reflects the platform-specific nature of the flaw.
Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. Systems running unpatched kernels before 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 on s390 architecture face potential kernel heap corruption with consequences ranging from denial of service to local privilege escalation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Uninitialized-value access in the Linux kernel's HFS+ filesystem driver allows a local attacker with mount privileges to trigger kernel memory corruption or information disclosure by supplying a crafted disk image containing an invalid btree node_size. The flaw is reached during the mount path - specifically in hfsplus_bnode_find() while loading the HFS+ catalog B-tree - when a corrupted node_size value (e.g., 1) causes an excessively large offset to be passed to hfs_bnode_read_u16(), resulting in use of uninitialized stack memory. No public exploit has been identified and EPSS is 0.15% (5th percentile); upstream stable patches are available at git.kernel.org.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
Unbounded W3C tracestate parsing in the datadog-opentelemetry Rust crate (dd-trace-rs) allows remote unauthenticated attackers to exhaust CPU and memory on any instrumented service by sending HTTP requests with an arbitrarily large or pair-dense dd= vendor entry in the tracestate header. Affected versions 0.1.0 through 0.3.2 are exposed under default configuration because tracecontext extraction is enabled without any opt-in, making every internet-facing Rust service using Datadog APM a viable target. No active exploitation is confirmed (not in CISA KEV), but the zero-configuration attack surface and published advisory make this a prompt remediation priority for affected deployments.
Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (passwords, OAuth tokens) by exploiting a URL validation flaw during HTTP redirects. Affected are gitoxide versions 0.25.4 through 0.55.0 using the curl backend; the reqwest backend implements correct cross-domain redirect blocking and is not affected. An attacker who controls or can influence a redirect response from a git server can cause gitoxide to send the victim's full credentials to an attacker-controlled host on subsequent POST requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.
Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.
Improper authentication enforcement in IBM Administration Runtime Expert for i 1R1M0 exposes sensitive information to remote attackers over the network. The flaw (CWE-287) allows an attacker to bypass or circumvent authentication controls on protected endpoints, resulting in high-confidentiality-impact disclosure with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node/7284580.
Credential disclosure in the MariaDB Connector for Node.js (npm: mariadb) exposes plaintext database passwords to active network attackers when SSL/TLS is configured without a CA or server certificate. Fingerprint-based server identity validation is sequenced after the authentication exchange, so a man-in-the-middle presenting any certificate receives the password before the connection is ultimately rejected and closed. Affected branches span all releases below 3.2.4, 3.3.3, 3.4.6, and 3.5.3; no CISA KEV entry or public proof-of-concept exists at time of analysis, though the flaw is structurally exploitable by any on-path attacker against the specific misconfiguration.
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU on the imap-login process by sending an IMAP ID command with an excessive number of parameters before completing authentication. When the out-of-memory handler terminates the affected imap-login process, all other IMAP connections multiplexed on that same process are simultaneously dropped, amplifying the impact beyond the single malicious session. No public exploits are known, but the low attack complexity and zero authentication requirement make this a practical DoS vector against any internet-exposed OX Dovecot deployment.
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, enabling unauthenticated denial of service against Sieve script management. The blast radius is mode-dependent: high-security mode (CE community default) limits disruption to the attacker's own connection, whereas high-performance mode (Pro default) terminates all connections sharing the same managesieve-login process, making repeated attacks an effective targeted DoS. No public exploit code exists and no CISA KEV listing is present, but the unauthenticated network vector with low complexity makes this straightforward to trigger.
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user by crafting an email whose headers contain an abnormally large number of addresses or MIME parameters. The malicious message passes delivery intact, but when the recipient's IMAP process parses it, uncontrolled memory allocation causes the process to hit its memory limit and terminate, interrupting that user's IMAP session. No public exploits are known and CISA has not added this to the KEV catalog, but the low attack complexity and lack of authentication requirements make this a realistic nuisance-level threat for any Dovecot deployment.
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers to bypass IP-based access controls on Go-based SSH servers using PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin authentication paths. Versions prior to 0.55.0 silently ignore source-address restrictions returned by these callbacks, defeating an explicit authorization control set by the server application. This is an incomplete fix extending CVE-2026-46595; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in DP Calendar for Joomla (versions 7.0.0 through 10.11.2) allows authenticated users holding the DPCalendar 'create' permission to inject persistent malicious script by submitting an unsanitized Location title, which is rendered into an HTML data attribute without output encoding. Any Joomla site visitor who subsequently loads a calendar page containing the poisoned entry will execute the attacker-controlled payload in their browser, enabling session hijacking or unauthorized actions on their behalf. No public exploit code and no active exploitation have been identified at time of analysis.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.
Unauthenticated network access to the getCloudSrvCheckStatus function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware check status information to any remote attacker who sends a crafted POST to /cgi-bin/cstecgi.cgi. The CWE-284 improper access control flaw requires no credentials or session token, though the leaked data - firmware update check status - is of modest sensitivity compared to credentials or full configuration disclosure. No public exploit code has been independently confirmed; technical details are publicly available via researcher coordination repositories, and EPSS at 0.18% reflects limited observed exploitation pressure at this time.
NULL pointer dereference in the Linux kernel IPv6 subsystem - specifically in `__in6_dev_stats_get()` - can crash the kernel and cause a denial of service when a physical network device is unregistered while IPv6 statistics are being collected. The vulnerability affects a wide range of stable kernel branches, from 4.19 through 7.x, and has been patched across all active LTS trees. No active exploitation is confirmed (not in CISA KEV) and EPSS at 0.18% (7th percentile) reflects low current real-world exploitation interest, though the ubiquitous deployment of the Linux kernel makes patch cadence important.
Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) indicates minimal current exploitation interest.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN interface, LAN addressing, and DHCP configuration to any network-reachable attacker without credentials. The getWanIeCfg CGI function accepts POST requests at /cgi-bin/cstecgi.cgi without enforcing access control, returning network topology data that can directly support further reconnaissance or targeted attacks. No public exploit has been identified at time of analysis; EPSS at 0.18% (7th percentile) and SSVC Exploitation: none both indicate no observed active threat activity.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control configuration data via the getCrpcConfig function at /cgi-bin/cstecgi.cgi. Any network-reachable attacker can submit a crafted POST request without credentials to retrieve the device's cloud remote-protocol-control (CRPC) enable status and management URL. No public exploit code is identified at time of analysis, and EPSS of 0.18% at the 7th percentile indicates minimal current exploitation interest despite the trivially low attack complexity.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve sensitive device initialization configuration by sending a crafted POST request to the `/cgi-bin/cstecgi.cgi` endpoint without credentials. The `getInitCfg` handler performs no access control checks before returning configuration data, confirmed by a CVSS PR:N vector. Despite a CVSS score of 7.5, exploitation likelihood is low - EPSS sits at 0.18% (7th percentile) and SSVC reports no observed exploitation - though the attack is fully automatable with no user interaction required.