Command injection in QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) lets remote attackers run arbitrary OS commands by manipulating the ipaddr argument of the /cgi-bin/net_tr.cgi CGI script. The flaw is remotely reachable without authentication and publicly available exploit code exists, but it is not listed in CISA KEV. Because QVidium has ceased operations, no fix will ever be issued, making every deployed unit permanently vulnerable.
Firmware signature verification bypass in Phison PS3111-S11 SATA SSD controller firmware allows an attacker to load arbitrary, attacker-signed firmware onto the drive. Because the controller validates RSA signatures against a public modulus stored inside the firmware image itself instead of an immutable hardware root of trust, an attacker can generate their own RSA key pair, sign malicious firmware, embed the matching modulus, and have the controller accept it as authentic. Publicly available exploit code exists (VulnCheck advisory and the 'psychite' toolkit); there is no public exploit identified as being used in active attacks at time of analysis.
Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.
Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.
OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated.
Command injection in RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices (firmware through 20260704) allows low-privileged remote attackers to execute arbitrary OS commands via the System Clock management endpoint. The vulnerable `exec()` call in `/xgatev1/system/datetime.php` accepts unsanitized user input, enabling shell metacharacter injection. A public proof-of-concept exploit has been disclosed via Feishu, the vendor did not respond to responsible disclosure, and no patch has been released, leaving operators without an official remediation path.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk.
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.
SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.
OS command injection in D-Link DNS-340L and DNS-345 NAS appliances (firmware through 20260717) allows authenticated network attackers to execute arbitrary operating system commands by supplying shell metacharacters in the alias, username, password, or volume_location arguments of the iSCSI management endpoint /cgi-bin/iscsi_mgr.cgi. A public proof-of-concept exploit has been disclosed, materially lowering the bar for opportunistic exploitation against devices with default or weak credentials. No CISA KEV listing has been identified, but the accessible attack surface and available POC make this a priority remediation item for any deployment with this NAS model exposed to untrusted networks.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows a low-privileged remote attacker to execute arbitrary operating system commands via the `upIsoRootPath` argument in `/cgi-bin/isomount_mgr.cgi`. All firmware versions through 20260717 are confirmed affected across all four models. A public proof-of-concept exploit is available, materially lowering the bar for exploitation, and no vendor patch has been identified - consistent with D-Link's history of leaving legacy NAS firmware unpatched.
Integer overflow in MSI Dragon Center's NTIOLib_X64.sys kernel-mode driver (versions up to 2.0.155.0) allows local low-privileged users to corrupt kernel memory via crafted count or elementSize arguments passed to the MmioWritePath MMIO Write Path Handler. Exploitation can yield full SYSTEM-level privilege escalation on the target host. A public proof-of-concept is available, the vendor did not respond to coordinated disclosure, and no official patch has been released.
OS command injection in D-Link DNS-327L and DNS-340L NAS devices (all firmware versions through 20260717) allows a remote authenticated attacker to execute arbitrary operating system commands by supplying crafted input to the f_dev parameter of the /cgi-bin/ve_mgr.cgi endpoint. A proof-of-concept exploit is publicly available, materially lowering the barrier for post-authentication abuse. Full OS-level compromise - including persistent backdoor installation and wholesale data exfiltration from attached storage - is achievable; this CVE is not currently listed in CISA KEV, so widespread active exploitation has not been confirmed.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CISA ICS advisory (ICSA-26-237-06) confirms the weakness.
Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-related operation, letting an attacker who can observe, manipulate, or predict the authentication exchange defeat the login mechanism and gain unauthorized access to the industrial serial-to-Ethernet device. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-237-06) and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Compromise of these edge/OT gateway devices can expose the serial equipment behind them, so despite the niche footprint the impact per device is high.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
Missing authorization controls in the Ebyte NA111-M industrial wireless module firmware allow a low-privileged authenticated user to access and modify administrative configuration functions that should be restricted to privileged accounts. The device fails to enforce privilege separation between limited-user and administrator roles, meaning any authenticated operator-level account can alter security-sensitive settings and affect device confidentiality, integrity, and availability. The attack is network-accessible with no user interaction required (CVSS 4.0: 8.7), posing a practical risk in OT/ICS environments; no public exploit has been identified at time of analysis.
Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). Reported by Patchstack; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Privilege-escalation-to-RCE in MCPHub before 0.12.15 lets any authenticated low-privileged user reach OS command execution via the POST /api/servers and PUT /api/servers/:name endpoints, which spawn a configured stdio process through child_process.spawn without an admin authorization check or command allowlist. Because command and args are attacker-controlled, a non-admin user can set command to /bin/sh (or any binary) and have MCPHub run it as its own OS user - frequently root in the published Docker image and in npx/systemd deployments. No public exploit identified at time of analysis, though the fixing PR (#770) and GHSA advisory publicly detail the root cause.
OS command injection in MetaGPT 0.8.1 allows an attacker who controls the path argument of RepoParser.rebuild_class_views() (metagpt/repo_parser.py) to execute arbitrary shell commands on the host running the framework. MetaGPT is an open-source LLM multi-agent development framework, and this flaw lets attacker-influenced repository/path input break out into command execution. A public exploit write-up exists; the issue is not in CISA KEV and EPSS is low (~0.47%).
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Tickera event ticketing plugin for WordPress in all versions up to and including 3.6.0.2, allowing remote attackers with no authentication to inject crafted serialized PHP objects into a deserialization sink. Reported by Patchstack and scored CVSS 9.8, the flaw can lead to high-impact compromise (confidentiality, integrity, and availability) if a suitable POP gadget chain is reachable in the plugin or its dependencies. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation.
Unauthenticated manipulation of the firmware upload/flash workflow in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible by sending crafted POST requests to the setUploadSetting handler in /cgi-bin/cstecgi.cgi, which lacks any authentication or access-control check (CWE-284). Any attacker with network reachability to the web interface can alter upload/flash settings, potentially corrupting or hijacking a firmware update and rendering the device inoperable. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating no observed mass exploitation despite the 9.8 CVSS rating.
Unauthorized DMZ reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker reach the setDmzCfg handler exposed by /cgi-bin/cstecgi.cgi and place an internal LAN host into the router's DMZ, making that host directly reachable from the internet. The flaw stems from a missing authentication/authorization check (CWE-284) on a state-changing configuration function. No public exploit or active exploitation is recorded, and EPSS is low (0.18%, 7th percentile), so this is a high-CVSS device flaw without evidence of widespread exploitation to date.
Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete MAC address filter rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delMacFilterRules function. Because no authentication is required, an attacker on the network path can silently strip a device-access control layer, potentially allowing previously blocked/rogue devices onto the LAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.16%, 6th percentile) despite the headline 9.8 CVSS.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reconfigure the device's VPN pass-through / edge-filtering settings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which fails to authenticate calls to the setVpnPassCfg function. Successful exploitation weakens the router's perimeter filtering, degrading the security posture protecting devices behind it. No public exploit code has been identified and the CVE is not on CISA KEV; EPSS is low at 0.16% (6th percentile).
Unauthenticated firmware upload in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets remote attackers push a crafted firmware image via the UploadFirmwareFile handler in /cgi-bin/cstecgi.cgi without any credentials. Because the device applies attacker-supplied firmware, this is effectively a full-device-takeover primitive yielding persistent code execution. No public exploit is identified at time of analysis; EPSS is low (0.16%, 6th percentile) despite the 9.8 CVSS.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete Smart QoS rules by sending a crafted POST request to the delSmartQosCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no access-control check, so any attacker able to reach the device's web interface can remove QoS configuration without credentials. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, so this reads as a broadly exploitable but not-yet-weaponized SOHO router flaw.
Root-level device takeover in the Tenda HG21 gateway (firmware V4.0.0-260302) stems from hardcoded credentials baked into the built-in Admin account, letting attackers authenticate and obtain full root access. The flaw is remotely reachable and requires no legitimate credentials since the login secret is static across devices, and a public GitHub gist writeup/exploit is available. It is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete static DHCP reservations without authentication by sending a crafted POST request to the delStaticDhcpRules handler in /cgi-bin/cstecgi.cgi. The affected endpoint fails to enforce access control (CWE-284), so any attacker who can reach the device's web management interface can invoke the function. No public exploit is identified at time of analysis and it is not on CISA KEV; the assigned CVSS of 9.8 appears inflated relative to the narrow, integrity-oriented impact actually described.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers abuse the setScheduleCfg handler on /cgi-bin/cstecgi.cgi to schedule forced reboot tasks without any credentials. Because the endpoint fails to enforce access control (CWE-284), a single crafted POST can register recurring reboots that render the device persistently unavailable, and the same missing check likely exposes other schedule/config parameters. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is trivial and network-reachable.
Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated Wi-Fi reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers rewrite primary wireless settings by POSTing to the setWiFiBasicCfg handler of /cgi-bin/cstecgi.cgi without any credentials. The CGI endpoint fails to enforce access control (CWE-284), so an attacker on a routable path to the device can change SSID/security parameters and hijack or disrupt the wireless network. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, though the CVSS 9.8 rating reflects the trivial, unauthenticated network vector.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.
GitList 2.0.0's XML-based commit parser in CommandLine.php can be remotely triggered without authentication to cause a denial-of-service condition, crashing or hanging the PHP process that renders the GitList interface. The root cause is PHP's SimpleXMLElement being used to parse git log output formatted as XML - commit content can be crafted to cause pathological resource consumption or unhandled parse failures (CWE-404). A public proof-of-concept exists per GitHub issue #948 and the CVSS 4.0 E:P exploitability modifier; the flaw is not listed in CISA KEV, so mass active exploitation is not confirmed at time of analysis.