Command injection in QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) lets remote attackers run arbitrary OS commands by manipulating the ipaddr argument of the /cgi-bin/net_tr.cgi CGI script. The flaw is remotely reachable without authentication and publicly available exploit code exists, but it is not listed in CISA KEV. Because QVidium has ceased operations, no fix will ever be issued, making every deployed unit permanently vulnerable.
Firmware signature verification bypass in Phison PS3111-S11 SATA SSD controller firmware allows an attacker to load arbitrary, attacker-signed firmware onto the drive. Because the controller validates RSA signatures against a public modulus stored inside the firmware image itself instead of an immutable hardware root of trust, an attacker can generate their own RSA key pair, sign malicious firmware, embed the matching modulus, and have the controller accept it as authentic. Publicly available exploit code exists (VulnCheck advisory and the 'psychite' toolkit); there is no public exploit identified as being used in active attacks at time of analysis.
Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.
Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CISA ICS advisory (ICSA-26-237-06) confirms the weakness.
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-related operation, letting an attacker who can observe, manipulate, or predict the authentication exchange defeat the login mechanism and gain unauthorized access to the industrial serial-to-Ethernet device. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-237-06) and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Compromise of these edge/OT gateway devices can expose the serial equipment behind them, so despite the niche footprint the impact per device is high.
Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). Reported by Patchstack; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Privilege-escalation-to-RCE in MCPHub before 0.12.15 lets any authenticated low-privileged user reach OS command execution via the POST /api/servers and PUT /api/servers/:name endpoints, which spawn a configured stdio process through child_process.spawn without an admin authorization check or command allowlist. Because command and args are attacker-controlled, a non-admin user can set command to /bin/sh (or any binary) and have MCPHub run it as its own OS user - frequently root in the published Docker image and in npx/systemd deployments. No public exploit identified at time of analysis, though the fixing PR (#770) and GHSA advisory publicly detail the root cause.
OS command injection in MetaGPT 0.8.1 allows an attacker who controls the path argument of RepoParser.rebuild_class_views() (metagpt/repo_parser.py) to execute arbitrary shell commands on the host running the framework. MetaGPT is an open-source LLM multi-agent development framework, and this flaw lets attacker-influenced repository/path input break out into command execution. A public exploit write-up exists; the issue is not in CISA KEV and EPSS is low (~0.47%).
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Tickera event ticketing plugin for WordPress in all versions up to and including 3.6.0.2, allowing remote attackers with no authentication to inject crafted serialized PHP objects into a deserialization sink. Reported by Patchstack and scored CVSS 9.8, the flaw can lead to high-impact compromise (confidentiality, integrity, and availability) if a suitable POP gadget chain is reachable in the plugin or its dependencies. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
Unauthorized DMZ reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker reach the setDmzCfg handler exposed by /cgi-bin/cstecgi.cgi and place an internal LAN host into the router's DMZ, making that host directly reachable from the internet. The flaw stems from a missing authentication/authorization check (CWE-284) on a state-changing configuration function. No public exploit or active exploitation is recorded, and EPSS is low (0.18%, 7th percentile), so this is a high-CVSS device flaw without evidence of widespread exploitation to date.
Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.
Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
Unauthenticated manipulation of the firmware upload/flash workflow in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible by sending crafted POST requests to the setUploadSetting handler in /cgi-bin/cstecgi.cgi, which lacks any authentication or access-control check (CWE-284). Any attacker with network reachability to the web interface can alter upload/flash settings, potentially corrupting or hijacking a firmware update and rendering the device inoperable. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating no observed mass exploitation despite the 9.8 CVSS rating.
Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.
Unauthenticated firmware upload in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets remote attackers push a crafted firmware image via the UploadFirmwareFile handler in /cgi-bin/cstecgi.cgi without any credentials. Because the device applies attacker-supplied firmware, this is effectively a full-device-takeover primitive yielding persistent code execution. No public exploit is identified at time of analysis; EPSS is low (0.16%, 6th percentile) despite the 9.8 CVSS.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reconfigure the device's VPN pass-through / edge-filtering settings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which fails to authenticate calls to the setVpnPassCfg function. Successful exploitation weakens the router's perimeter filtering, degrading the security posture protecting devices behind it. No public exploit code has been identified and the CVE is not on CISA KEV; EPSS is low at 0.16% (6th percentile).
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers manipulate port-forwarding rules via a crafted POST to /cgi-bin/cstecgi.cgi, exposing internal LAN services to the internet. The setPortForwardRules handler fails to enforce authentication, so anyone able to reach the device's web interface can create NAT/forwarding entries. CVSS is rated 9.8 (critical); no public exploit is identified at time of analysis and EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete Smart QoS rules by sending a crafted POST request to the delSmartQosCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no access-control check, so any attacker able to reach the device's web interface can remove QoS configuration without credentials. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, so this reads as a broadly exploitable but not-yet-weaponized SOHO router flaw.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete MAC address filter rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delMacFilterRules function. Because no authentication is required, an attacker on the network path can silently strip a device-access control layer, potentially allowing previously blocked/rogue devices onto the LAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.16%, 6th percentile) despite the headline 9.8 CVSS.
Root-level device takeover in the Tenda HG21 gateway (firmware V4.0.0-260302) stems from hardcoded credentials baked into the built-in Admin account, letting attackers authenticate and obtain full root access. The flaw is remotely reachable and requires no legitimate credentials since the login secret is static across devices, and a public GitHub gist writeup/exploit is available. It is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete static DHCP reservations without authentication by sending a crafted POST request to the delStaticDhcpRules handler in /cgi-bin/cstecgi.cgi. The affected endpoint fails to enforce access control (CWE-284), so any attacker who can reach the device's web management interface can invoke the function. No public exploit is identified at time of analysis and it is not on CISA KEV; the assigned CVSS of 9.8 appears inflated relative to the narrow, integrity-oriented impact actually described.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers abuse the setScheduleCfg handler on /cgi-bin/cstecgi.cgi to schedule forced reboot tasks without any credentials. Because the endpoint fails to enforce access control (CWE-284), a single crafted POST can register recurring reboots that render the device persistently unavailable, and the same missing check likely exposes other schedule/config parameters. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is trivial and network-reachable.
Unauthenticated Wi-Fi reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers rewrite primary wireless settings by POSTing to the setWiFiBasicCfg handler of /cgi-bin/cstecgi.cgi without any credentials. The CGI endpoint fails to enforce access control (CWE-284), so an attacker on a routable path to the device can change SSID/security parameters and hijack or disrupt the wireless network. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, though the CVSS 9.8 rating reflects the trivial, unauthenticated network vector.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle WPS availability by sending a crafted POST request to the setWiFiWpsCfg handler at /cgi-bin/cstecgi.cgi. The setter enforces no access control (CWE-284), so any attacker who can reach the device's web interface can change a security-relevant wireless setting without credentials. No public exploit or active exploitation has been identified at time of analysis; the finding was reported via MITRE.
Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into outgoing mail by planting CRLF characters in the envelope.size value, silently adding attacker-controlled recipients or otherwise manipulating the MAIL FROM dialogue. Only applications that pass a custom envelope object and expose its size property to untrusted input are affected, since Nodemailer's default auto-constructed envelope never sets size. A working proof-of-concept is published in the GHSA advisory; there is no public exploit identified beyond that PoC and no evidence of active exploitation.
OS command injection in the Digitální a informační agentura (DIA) eObčanka-Identifikace macOS client (the Czech national electronic-ID 'eOP' identification app) lets a remote attacker execute arbitrary shell commands by luring a victim to open a crafted czeeopauth:// URL. Versions prior to 3.6.0 pass incoming URL-scheme parameters into a compiled AppleScript wrapper via string concatenation without sanitization, so attacker-controlled input breaks out of the intended command. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 9.3 rating reflects unauthenticated network-reachable code execution requiring only that the user follow a malicious link.
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. No public exploit identified at time of analysis, and Google states the issue was patched server-side with no customer action required.
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy guardrail (CIS 1.16) by crafting admin-equivalent inline or attached IAM policy shapes that the validator failed to fully inspect. Any environment relying on this library to detect over-privileged IAM policies could silently pass admin-equivalent access as compliant. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configurations to pass automated policy inspection. The G_OIDC_1 trust-policy inspector only matched exact StringLike/StringEquals condition operators, so set-qualified operators like ForAnyValue:StringLike could smuggle wildcard GitHub Actions OIDC 'sub' conditions past the mandatory check, letting an overly permissive AWS role assumption go undetected. Reported by VulnCheck; no public exploit is identified at time of analysis, and it is not on CISA KEV. The CVSS 4.0 score is 9.3 (Critical).
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the Throws SPAM Away WordPress anti-spam plugin (versions 3.8.2 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing WordPress database contents such as user records and secrets. The CVSS 3.1 base score is 9.3 (S:C), reflecting network reach and no authentication. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fixed release (1.3.2) and a GHSA advisory are available.
Local privilege escalation in Colorful iGameCenter 2.0.0.81 stems from its bundled WinRing0x64.sys driver, whose sub_11504 IOCTL handler exposes arbitrary physical-memory access via attacker-controlled PhysicalAddress/AlignNumer/AlignSize arguments. A low-privileged local user can abuse this IOCTL Dispatch path to read and write kernel-visible physical memory and escalate to SYSTEM. Publicly available exploit code exists for the underlying WinRing0 driver class, but this specific CVE is not listed in CISA KEV and EPSS is unavailable; no active exploitation is confirmed.
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.
Improper access control in the delParentalRules handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The action requires no authentication (PR:N) and is automatable, though EPSS is low (0.18%) and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, so this is a real but not-yet-exploited network-reachable weakness.