What is the CVSS score of CVE-2026-35906?

CVE-2026-35906 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of T3 Technology CPE are affected by CVE-2026-35906?

T3 Technology CPE routers (models T625Pro v1.0.07 and T6825G v1.0.03) contain a critical unauthenticated remote code execution vulnerability through an undocumented debug endpoint; publicly available…

How to fix or mitigate CVE-2026-35906?

24 hours: Conduct full inventory of affected models (T625Pro v1.0.07 and T6825G v1.0.03); map which devices are internet-facing or connected to untrusted networks; activate incident response procedures. 7 days: Contact T3 Technology for patch ETA and interim guidance; implement network segmentation or firewall access controls isolating affected routers from critical systems; deploy IDS monitoring for exploitation attempts. 30 days: Apply vendor-released patch to all affected units immediately upon release, or execute replacement strategy if patch timeline exceeds organizational risk appetite.

T3 Technology CPE CVE-2026-35906

EUVD-2026-34276 CRITICAL

OS Command Injection (CWE-78)

2026-06-04 mitre

GHSA-9qwx-6gr4-xcgx

Command Injection N A

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 16:51 vuln.today

CVSS changed

Jun 04, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.

AnalysisAI

Unauthenticated remote command execution affects T3 Technology CPE routers (models T625Pro v1.0.07 and T6825G v1.0.03) through an undocumented debug CGI endpoint that processes attacker-supplied query strings as root-level shell commands. SSVC characterizes this as POC-available with total technical impact, and a public advisory has been published on GitHub, though it is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-78 OS Command Injection in a CGI handler exposed by the embedded web management interface of T3 Technology customer-premises equipment (CPE), devices typically deployed by ISPs (the references include Thai ISP True and Thai national CSIRT NCSA, suggesting regional deployment). CGI endpoints on embedded routers commonly pass query-string parameters through shell interpreters or popen()-style calls without sanitization, allowing metacharacters (e.g., ;, |, `, $()) to break out of the intended command context. Because the endpoint is undocumented, it was likely left in firmware for vendor debugging and not removed before shipping. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a) and does not formally enumerate the device, so authoritative product mapping must rely on the description.

RemediationAI

No vendor-released patch identified at time of analysis - the references include the vendor's homepage but no firmware advisory or fixed version, so operators should contact T3 Technology directly and consult the researcher write-up at https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35906.md for technical detail and any disclosed indicators. Until firmware is updated, restrict access to the device web management interface using ACLs so the CGI endpoint is reachable only from trusted management VLANs or the ISP's provisioning network (this breaks remote subscriber self-service if exposed on the WAN side, which is the common deployment); block inbound HTTP/HTTPS on the WAN interface where feasible, and place the device behind a perimeter firewall that drops external connections to TCP/80 and TCP/443. If the debug CGI path is documented in the GitHub advisory, add a reverse-proxy or upstream WAF rule to reject requests to that specific path, accepting that this may disrupt any legitimate diagnostic tooling that relies on it. Monitor web-server logs for suspicious query strings containing shell metacharacters targeting CGI paths.