What is the CVSS score of CVE-2026-35904?

CVE-2026-35904 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of T3 Technology CPE are affected by CVE-2026-35904?

T3 Technology CPE devices (T625Pro, T6825G, T7281) contain a critical vulnerability allowing unauthenticated remote Telnet activation via the web management interface, enabling attackers to gain…

How to fix or mitigate CVE-2026-35904?

24 hours: Audit network inventory to identify all affected T3 device models (T625Pro v1.0.07, T6825G v1.0.03, T7281 v1.0.03); restrict HTTP/HTTPS access to the web management interface to authorized administrative IP ranges only via firewall rules. 7 days: Contact T3 Technology for security guidance and remediation timeline; implement network segmentation to isolate affected CPE devices from general network traffic and establish monitoring for exploitation attempts. 30 days: Develop and execute replacement or upgrade plan for affected devices; complete migration to patched or alternative equipment.

T3 Technology CPE CVE-2026-35904

EUVD-2026-34274 CRITICAL

Improper Access Control (CWE-284)

2026-06-04 mitre

GHSA-2cm6-668w-rvw2

Authentication Bypass N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:50 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

Jun 04, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component.

AnalysisAI

Unauthenticated Telnet service activation in T3 Technology CPE devices (models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03) allows remote attackers to enable Telnet by sending a crafted request to a vulnerable CGI component in the web management interface. SSVC scores the technical impact as total with automatable exploitation and a public proof-of-concept available, although EPSS remains low at 0.02% and the CVE is not currently listed in CISA KEV.

Technical ContextAI

T3 Technology CPE devices are customer-premises equipment (often deployed by ISPs such as True Corporation in Thailand, with NCSA referenced as a reporting body) that expose a web-based management interface backed by CGI scripts. The flaw is classified as CWE-284 (Improper Access Control): a CGI endpoint responsible for toggling administrative services - specifically the Telnet daemon - fails to enforce authentication or authorization checks, so any client able to reach the management interface can invoke privileged service-control functionality. Enabling Telnet on embedded devices is particularly consequential because Telnet transmits credentials in cleartext and historically has weak or default credentials on CPE firmware, providing a secondary foothold for full device compromise.

RemediationAI

No vendor-released patch identified at time of analysis; the T3 Technology vendor site (https://t3techgroup.com) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-35904) do not currently reference a fixed firmware version. As compensating controls, restrict access to the CPE web management interface to trusted LAN segments only and explicitly block management access from the WAN side (this may disrupt remote ISP provisioning workflows and should be coordinated with the operator). Place the devices behind an ACL or firewall that drops inbound traffic to the management TCP ports from untrusted sources, and proactively disable the Telnet service and monitor for unexpected re-enablement (any Telnet listener appearing on these devices should be treated as an indicator of exploitation). ISPs deploying these CPEs should consult the third-party advisory at https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35904.md and pressure the vendor for a firmware update; in the interim, an inline IDS/IPS signature for the vulnerable CGI request pattern would catch active exploitation attempts at the cost of additional inspection overhead.