Race condition in the Linux kernel's ALSA OSS sequencer layer exposes local low-privilege attackers to kernel ring-buffer state corruption via unsynchronized reset operations. Specifically, snd_seq_oss_readq_clear() modifies qlen, head, and tail fields without holding q->lock, racing against reader and producer paths that correctly acquire the spinlock, potentially leaving stale or dropped MIDI events and corrupted readiness state. No public exploit identified at time of analysis; EPSS at 0.17% (6th percentile) indicates negligible current exploitation interest despite the CVSS 7.8 score reflecting theoretical kernel memory corruption severity.
Bitmap overflow and incorrect global accounting in the Linux kernel's percpu-km memory allocator (`mm/percpu-km`) allow a local low-privileged attacker on SMP/NUMA systems to corrupt kernel memory, with potential for privilege escalation or kernel crash. Two separate commits introduced the flaws: a63d4ac4ab609 caused `pcpu_create_chunk()` to write beyond the `chunk->populated` bitmap when `nr_units > 1`, and b539b87fed37f introduced the companion `pcpu_nr_empty_pop_pages` accounting error. Fixes have been backported to eight stable kernel branches (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2); no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel ALSA PCM subsystem allows a local low-privilege attacker to corrupt kernel memory by exploiting a race between snd_pcm_drain() and snd_pcm_unlink() on linked streams. When a drain wait terminates by signal or timeout while group membership is concurrently modified by an unlink, a stack-allocated wait queue entry is left queued on a freed peer stream's sleep list; a subsequent wake_up() call then dereferences that freed stack frame. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS of 0.16% (6th percentile) reflects low near-term exploitation probability.
Out-of-bounds read and write vulnerabilities in the Linux kernel's softing CAN driver `fw_parse()` function allow a local low-privileged attacker to corrupt kernel DPRAM memory by supplying a crafted firmware image. Affected kernels span from 2.6.38 through pre-patch stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2), with fixes backported across all active stable trees. No public exploit or active exploitation has been identified at time of analysis.
Heap out-of-bounds memory access in the Linux kernel s390/zcrypt subsystem exposes EP11 crypto card administrative paths to local low-privileged users. The flaw resides in the domain value upper-limit check processed when sending EP11 CPRBs (Control Program Request Blocks) through custom zcrypt device nodes - the missing AP_DOMAINS (256) ceiling allows an attacker-supplied domain index to reach heap memory beyond the `perms->adm` structure. No public exploit code has been identified and this is not listed in CISA KEV, but the CVSS 7.8 local vector and confirmed multi-version patch backports across stable kernel branches indicate the Linux security team treats the impact as high. EPSS at 0.16% (6th percentile) reflects the platform-specific nature of the flaw.
Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. Systems running unpatched kernels before 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 on s390 architecture face potential kernel heap corruption with consequences ranging from denial of service to local privilege escalation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Uninitialized-value access in the Linux kernel's HFS+ filesystem driver allows a local attacker with mount privileges to trigger kernel memory corruption or information disclosure by supplying a crafted disk image containing an invalid btree node_size. The flaw is reached during the mount path - specifically in hfsplus_bnode_find() while loading the HFS+ catalog B-tree - when a corrupted node_size value (e.g., 1) causes an excessively large offset to be passed to hfs_bnode_read_u16(), resulting in use of uninitialized stack memory. No public exploit has been identified and EPSS is 0.15% (5th percentile); upstream stable patches are available at git.kernel.org.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.
OS command injection in openNDS before 11.0.0 allows an authenticated captive portal user to execute arbitrary shell commands on the host router by embedding semicolons in HTTP GET query parameter names sent to the client_params.sh script. The daemon-invoked script passes unsanitized parameter keys directly into shell commands, making the exploitation straightforward once an attacker has portal authentication. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available targeting version 11.0.0.
Non-constant-time authentication comparisons and plaintext logging of XRES* in free5GC's AUSF component (v1.4.4 and earlier) expose two distinct vulnerability classes under CWE-208. The 5G-AKA confirmation path writes the expected XRES* value to INFO-level application logs immediately before comparison, making authentication material directly readable by any principal with AUSF log access - operators, SIEM agents, log-collection sidecars, or compromised containers. Both 5G-AKA and EAP-AKA' confirmation paths use non-constant-time Go primitives (strings.EqualFold, bytes.Equal, ==) instead of crypto/subtle.ConstantTimeCompare, though the researcher's own PoC confirmed the timing signal is too small to distinguish from HTTP/SBI noise under standard network conditions. No public exploit or CISA KEV listing; patched in v1.4.5.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
Unbounded W3C tracestate parsing in the datadog-opentelemetry Rust crate (dd-trace-rs) allows remote unauthenticated attackers to exhaust CPU and memory on any instrumented service by sending HTTP requests with an arbitrarily large or pair-dense dd= vendor entry in the tracestate header. Affected versions 0.1.0 through 0.3.2 are exposed under default configuration because tracecontext extraction is enabled without any opt-in, making every internet-facing Rust service using Datadog APM a viable target. No active exploitation is confirmed (not in CISA KEV), but the zero-configuration attack surface and published advisory make this a prompt remediation priority for affected deployments.
Memory exhaustion via unbounded URL fetch in vLLM up to 0.17.0 allows remote unauthenticated attackers to crash the inference server by supplying a multimodal API request pointing to an arbitrarily large file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py use aiohttp to retrieve user-controlled URLs but call r.read() with no response-size cap, meaning the server will buffer the entire remote payload into process memory. No public exploit confirmation or CISA KEV listing exists at time of analysis; however, the attack surface is trivially reachable against any vLLM deployment accepting multimodal API requests without network-layer restrictions.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (passwords, OAuth tokens) by exploiting a URL validation flaw during HTTP redirects. Affected are gitoxide versions 0.25.4 through 0.55.0 using the curl backend; the reqwest backend implements correct cross-domain redirect blocking and is not affected. An attacker who controls or can influence a redirect response from a git server can cause gitoxide to send the victim's full credentials to an attacker-controlled host on subsequent POST requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.
Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.
Improper authentication enforcement in IBM Administration Runtime Expert for i 1R1M0 exposes sensitive information to remote attackers over the network. The flaw (CWE-287) allows an attacker to bypass or circumvent authentication controls on protected endpoints, resulting in high-confidentiality-impact disclosure with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node/7284580.
Credential disclosure in the MariaDB Connector for Node.js (npm: mariadb) exposes plaintext database passwords to active network attackers when SSL/TLS is configured without a CA or server certificate. Fingerprint-based server identity validation is sequenced after the authentication exchange, so a man-in-the-middle presenting any certificate receives the password before the connection is ultimately rejected and closed. Affected branches span all releases below 3.2.4, 3.3.3, 3.4.6, and 3.5.3; no CISA KEV entry or public proof-of-concept exists at time of analysis, though the flaw is structurally exploitable by any on-path attacker against the specific misconfiguration.
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU on the imap-login process by sending an IMAP ID command with an excessive number of parameters before completing authentication. When the out-of-memory handler terminates the affected imap-login process, all other IMAP connections multiplexed on that same process are simultaneously dropped, amplifying the impact beyond the single malicious session. No public exploits are known, but the low attack complexity and zero authentication requirement make this a practical DoS vector against any internet-exposed OX Dovecot deployment.
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, enabling unauthenticated denial of service against Sieve script management. The blast radius is mode-dependent: high-security mode (CE community default) limits disruption to the attacker's own connection, whereas high-performance mode (Pro default) terminates all connections sharing the same managesieve-login process, making repeated attacks an effective targeted DoS. No public exploit code exists and no CISA KEV listing is present, but the unauthenticated network vector with low complexity makes this straightforward to trigger.
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user by crafting an email whose headers contain an abnormally large number of addresses or MIME parameters. The malicious message passes delivery intact, but when the recipient's IMAP process parses it, uncontrolled memory allocation causes the process to hit its memory limit and terminate, interrupting that user's IMAP session. No public exploits are known and CISA has not added this to the KEV catalog, but the low attack complexity and lack of authentication requirements make this a realistic nuisance-level threat for any Dovecot deployment.
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.
Resource exhaustion in OWASP json-sanitizer v1.2.3 allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted payload to the JsonSanitizer.sanitize() method. Any Java application that passes untrusted or externally supplied input through this library is affected, making the attack surface proportional to the library's adoption in internet-facing services. SSVC classifies this as automatable with no confirmed exploitation at time of analysis, and no public exploit code has been identified.
Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers to bypass IP-based access controls on Go-based SSH servers using PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin authentication paths. Versions prior to 0.55.0 silently ignore source-address restrictions returned by these callbacks, defeating an explicit authorization control set by the server application. This is an incomplete fix extending CVE-2026-46595; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in DP Calendar for Joomla (versions 7.0.0 through 10.11.2) allows authenticated users holding the DPCalendar 'create' permission to inject persistent malicious script by submitting an unsanitized Location title, which is rendered into an HTML data attribute without output encoding. Any Joomla site visitor who subsequently loads a calendar page containing the poisoned entry will execute the attacker-controlled payload in their browser, enabling session hijacking or unauthorized actions on their behalf. No public exploit code and no active exploitation have been identified at time of analysis.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.
Unauthenticated network access to the getCloudSrvCheckStatus function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware check status information to any remote attacker who sends a crafted POST to /cgi-bin/cstecgi.cgi. The CWE-284 improper access control flaw requires no credentials or session token, though the leaked data - firmware update check status - is of modest sensitivity compared to credentials or full configuration disclosure. No public exploit code has been independently confirmed; technical details are publicly available via researcher coordination repositories, and EPSS at 0.18% reflects limited observed exploitation pressure at this time.
NULL pointer dereference in the Linux kernel IPv6 subsystem - specifically in `__in6_dev_stats_get()` - can crash the kernel and cause a denial of service when a physical network device is unregistered while IPv6 statistics are being collected. The vulnerability affects a wide range of stable kernel branches, from 4.19 through 7.x, and has been patched across all active LTS trees. No active exploitation is confirmed (not in CISA KEV) and EPSS at 0.18% (7th percentile) reflects low current real-world exploitation interest, though the ubiquitous deployment of the Linux kernel makes patch cadence important.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected client MAC addresses to any remote attacker via the getStationMacByIp CGI function. The /cgi-bin/cstecgi.cgi endpoint processes crafted POST requests without enforcing any access control, returning MAC address data that can enable network reconnaissance and bypass of MAC-based access filtering. No confirmed active exploitation or CISA KEV listing exists, and EPSS probability is negligible at 0.18%, though the fully unauthenticated network vector makes automated scanning trivial.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the router's DMZ configuration to any network-reachable attacker. The getDmzCfg function in /cgi-bin/cstecgi.cgi fails to enforce access controls, allowing crafted POST requests to return DMZ host mappings and related network settings without credentials. No active exploitation is confirmed (absent from CISA KEV), though GitHub vendor-coordination repositories indicate researcher involvement and potential public disclosure of attack methodology.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control (CRPC) status and management URL through the getCrpcCfg function. The /cgi-bin/cstecgi.cgi endpoint processes POST requests without enforcing access control, allowing any network-adjacent attacker to enumerate whether cloud remote management is active and retrieve its target URL. No public exploit has been identified at time of analysis and EPSS sits at the 7th percentile, indicating low current exploitation pressure despite the trivially simple attack vector.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh routing table data through the getMeshRoutingTable CGI function. An attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve internal mesh routing topology without any credentials. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.18%, though GitHub-hosted CVE coordination repositories suggest researcher awareness and POC development activity.
Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) indicates minimal current exploitation interest.
Unauthenticated online client enumeration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected device information to any attacker who can reach the router's HTTP management interface. The getOnlineClient function within the /cgi-bin/cstecgi.cgi CGI dispatcher applies no access control, so a crafted POST request returns the router's live client inventory without credentials. No public exploit has been identified at time of analysis and the EPSS score sits at 0.18% (7th percentile), indicating this is not being exploited at scale - consistent with a batch of researcher-coordinated disclosures across multiple T6 CGI endpoints rather than active threat actor campaigns.
Unauthenticated remote access to setup wizard and onboarding configuration is possible on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 through missing access control on the getWizardCfg CGI handler. Any attacker reachable to the device's web management interface can send a crafted POST to /cgi-bin/cstecgi.cgi and receive wizard configuration data - which may include ISP connection parameters or other sensitive values collected during initial device setup - without supplying credentials. No active exploitation has been identified (EPSS 0.18%, 7th percentile; not in CISA KEV), and disclosure follows a researcher-coordinated process documented on GitHub.
Unauthenticated network topology and interface configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with access to the device's web management interface to retrieve sensitive network layout data without credentials. The getNetInfoCfg function in /cgi-bin/cstecgi.cgi enforces no access control, so a single crafted POST request returns interface and topology details that support downstream reconnaissance and targeted follow-on attacks. No public exploit code is confirmed and EPSS sits at 0.18% (7th percentile), but SOHO routers are frequently internet-exposed with factory defaults intact, elevating practical risk above what EPSS alone implies.
Unauthenticated remote-management configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes whether remote administration is enabled and on which port, via a crafted POST to /cgi-bin/cstecgi.cgi invoking the getRemoteCfg function. The root cause is CWE-284 incorrect access control - no authentication check gates the function before returning configuration data. No public exploit or KEV listing exists at time of analysis, but the endpoint is automatable per SSVC, making it trivial to mass-scan for affected devices.
Unauthenticated DMZ configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes internal network topology data to any attacker who can reach the router's web interface. The `getUrlFilterRules` handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control before returning DMZ forwarding configuration - including internal host addresses and ports - in response to a crafted POST request. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile), though SSVC confirms the attack vector is automatable.
Unauthenticated WAN configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with network access to the router management interface to retrieve WAN interface data - potentially including ISP credentials - by sending a single crafted POST request to /cgi-bin/cstecgi.cgi without any authentication. This is part of a documented pattern of missing access control enforcement across multiple CGI endpoint functions in this firmware version, with coordinated disclosure references confirming the finding. No public exploit code has been identified at time of analysis, and SSVC classifies the technical impact as partial, though the fully automated exploitation path (SSVC Automatable: yes) elevates practical risk for internet-exposed devices.
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Wi-Fi credentials - including SSIDs and plaintext Wi-Fi keys - to any attacker on the network or internet who can reach the device's web interface. The getWiFiEasyCfg function in the CGI handler accepts POST requests without enforcing authentication, classifying this as CWE-284 improper access control rather than a logic bypass. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but two independent researcher disclosure repositories on GitHub reference this CVE, consistent with coordinated disclosure that may include proof-of-concept detail.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes DDNS runtime status and the router's public IP address to any network-reachable attacker. The getDdnsStatus function in the CGI interface fails to enforce access control, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return sensitive network configuration without credentials. No active exploitation is confirmed (CISA KEV absent, EPSS at 0.18%), though SSVC notes the attack is automatable with no required privileges or user interaction.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve sensitive device initialization configuration by sending a crafted POST request to the `/cgi-bin/cstecgi.cgi` endpoint without credentials. The `getInitCfg` handler performs no access control checks before returning configuration data, confirmed by a CVSS PR:N vector. Despite a CVSS score of 7.5, exploitation likelihood is low - EPSS sits at 0.18% (7th percentile) and SSVC reports no observed exploitation - though the attack is fully automatable with no user interaction required.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control configuration data via the getCrpcConfig function at /cgi-bin/cstecgi.cgi. Any network-reachable attacker can submit a crafted POST request without credentials to retrieve the device's cloud remote-protocol-control (CRPC) enable status and management URL. No public exploit code is identified at time of analysis, and EPSS of 0.18% at the 7th percentile indicates minimal current exploitation interest despite the trivially low attack complexity.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN interface, LAN addressing, and DHCP configuration to any network-reachable attacker without credentials. The getWanIeCfg CGI function accepts POST requests at /cgi-bin/cstecgi.cgi without enforcing access control, returning network topology data that can directly support further reconnaissance or targeted attacks. No public exploit has been identified at time of analysis; EPSS at 0.18% (7th percentile) and SSVC Exploitation: none both indicate no observed active threat activity.
Unauthenticated LAN and DHCP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve internal network topology data by sending a crafted POST request to /cgi-bin/cstecgi.cgi without any credentials. The getLanCfg CGI handler applies no access control before returning LAN addressing and DHCP server configuration. EPSS at 0.18% (7th percentile) and SSVC 'Exploitation: none' confirm no observed active exploitation; no CISA KEV listing or public exploit code has been identified at time of analysis.
Null pointer dereference in the Linux kernel's SCSI target iblock driver crashes the kernel when processing Persistent Reservation PREEMPT or RELEASE operations against storage backends with unimplemented PR hooks. Systems running the kernel as an iSCSI target are vulnerable - an attacker who can issue SCSI Persistent Reservation commands can trigger a kernel panic, causing a complete denial of service. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but patches are available across multiple stable branches and should be applied promptly on iSCSI target infrastructure.