Monthly
An undocumented root-level backdoor in the DJI CrystalSky ZS600C 'assistant' daemon allows a physically present attacker with USB access to execute arbitrary OS commands as root on firmware 0.3.9.7 through 0.6.6.9. Sending the hard-coded string 'dji26656677' to /dev/ttyGS0 unlocks a mode in which each subsequent line is passed to system(), with no authentication or user interaction required once USB access is obtained. The physical-access prerequisite is the dominant limiting factor: devices kept in continuous custody are not exposed, while units that leave custody during shipping, loan, resale or shared use are at risk; no public exploit identified at time of analysis.
Arbitrary OS command execution in multiple Atsumi Electric DVR models (ADX1004, ADX1008, ADX204, ADX404, ADX3004, ADX3008, ADX3016, ADX5004, ADX5008 and ADX2016) is enabled by an undocumented hidden function reachable by an administrator-level user, with high confidentiality, integrity and availability impact (CVSS 8.6 CVSS 4.0; assessed CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid administrator credentials (PR:H) and network reachability to the management interface, but no user interaction and low attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated where admin passwords are default, weak or reused, or where the DVR management interface is exposed to untrusted networks.
Netis EAP930 access point firmware (build 1.250905.115454) ships a hidden backdoor in the /cgi-bin/debug CGI endpoint, where the return200 function activates concealed functionality when the SIGNATURE argument is manipulated with a specific value. The defect is remotely reachable over the network but is a constrained threat rather than a broadly exploitable one: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) requires a high-privilege context and a non-trivial barrier - knowing or forging the correct SIGNATURE - and the vendor itself rates exploitability as difficult. The CVSS v4 vector carries an E:P (proof-of-concept) exploit maturity rating, but no confirmed active exploitation or CISA KEV listing was identified at time of analysis, and Netis did not respond to the disclosure, so no vendor-released patch has been identified.
Hard-coded credentials and undocumented hidden accounts in Hitachi Coding Software Suite (versions through 3.3.0) allow a remote attacker who possesses those credentials to bypass authentication entirely and obtain full read/write/execute-level control of the affected installation, matching the vendor's CVSS 4.0 rating of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). The only prerequisites are network reachability to the host plus knowledge of the embedded credentials, which is consistent with the independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no public disclosure of the specific credentials have been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); because these systems are industrial coding/marking control platforms often deployed on segmented OT networks, actual exposure depends on whether an attacker has a viable network path to the installation.
Authenticated SSH users who can reach privileged 'enable' mode on Lite-On FF-RFI079I4 and FF-RFI078I4 5G FlexFi devices can invoke an undocumented hidden function (CWE-912) to execute arbitrary OS commands, giving full control of the appliance with high confidentiality, integrity, and availability impact. Firmware versions below 02.01.15 are affected and a vendor fix is available. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor/JVN rates the issue CVSS 4.0 8.7 (PR:L, UI:N).
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Unauthorized BLE command injection against the Pulsetto Vagus Nerve Stimulator firmware allows any physically proximate attacker to invoke hidden device commands without authentication or encryption, with potential to alter stimulation parameters or disrupt device operation. The firmware processes a set of undisclosed commands - never exposed through the official companion mobile application - whenever the device is powered on and advertising over BLE, presenting a zero-authentication attack surface at the radio layer. No public exploit code has been identified at time of analysis, but the adjacent-only, no-authentication requirement makes opportunistic abuse practical in any clinical or public setting where patients wear the device.
Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. Reported by WPScan; no public exploit is identified and the issue is not listed in CISA KEV at time of analysis, though the delivery mechanism means the implant is effectively pre-planted rather than requiring an active attack against each target.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Supply-chain compromise of MonsterInsights Pro, a widely used WordPress Google Analytics plugin, delivered a malicious file (class-system-check.php) through the vendor's own S3 update bucket (monster-insights.s3.amazonaws.com). Both the current release (10.2.2) and the 10.2.0 build the vendor rolled back to are trojaned, so administrators who updated - or downgraded to remediate - received attacker-controlled PHP that runs with full site privileges. WPScan reports the attacker still holds write access to the bucket and was iterating on three AES-256-GCM payload variants on 2026-06-11; there is no CISA KEV listing and no public exploit code, but the malicious distribution is described as active and ongoing by the reporter.
An undocumented root-level backdoor in the DJI CrystalSky ZS600C 'assistant' daemon allows a physically present attacker with USB access to execute arbitrary OS commands as root on firmware 0.3.9.7 through 0.6.6.9. Sending the hard-coded string 'dji26656677' to /dev/ttyGS0 unlocks a mode in which each subsequent line is passed to system(), with no authentication or user interaction required once USB access is obtained. The physical-access prerequisite is the dominant limiting factor: devices kept in continuous custody are not exposed, while units that leave custody during shipping, loan, resale or shared use are at risk; no public exploit identified at time of analysis.
Arbitrary OS command execution in multiple Atsumi Electric DVR models (ADX1004, ADX1008, ADX204, ADX404, ADX3004, ADX3008, ADX3016, ADX5004, ADX5008 and ADX2016) is enabled by an undocumented hidden function reachable by an administrator-level user, with high confidentiality, integrity and availability impact (CVSS 8.6 CVSS 4.0; assessed CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid administrator credentials (PR:H) and network reachability to the management interface, but no user interaction and low attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated where admin passwords are default, weak or reused, or where the DVR management interface is exposed to untrusted networks.
Netis EAP930 access point firmware (build 1.250905.115454) ships a hidden backdoor in the /cgi-bin/debug CGI endpoint, where the return200 function activates concealed functionality when the SIGNATURE argument is manipulated with a specific value. The defect is remotely reachable over the network but is a constrained threat rather than a broadly exploitable one: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) requires a high-privilege context and a non-trivial barrier - knowing or forging the correct SIGNATURE - and the vendor itself rates exploitability as difficult. The CVSS v4 vector carries an E:P (proof-of-concept) exploit maturity rating, but no confirmed active exploitation or CISA KEV listing was identified at time of analysis, and Netis did not respond to the disclosure, so no vendor-released patch has been identified.
Hard-coded credentials and undocumented hidden accounts in Hitachi Coding Software Suite (versions through 3.3.0) allow a remote attacker who possesses those credentials to bypass authentication entirely and obtain full read/write/execute-level control of the affected installation, matching the vendor's CVSS 4.0 rating of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). The only prerequisites are network reachability to the host plus knowledge of the embedded credentials, which is consistent with the independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no public disclosure of the specific credentials have been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); because these systems are industrial coding/marking control platforms often deployed on segmented OT networks, actual exposure depends on whether an attacker has a viable network path to the installation.
Authenticated SSH users who can reach privileged 'enable' mode on Lite-On FF-RFI079I4 and FF-RFI078I4 5G FlexFi devices can invoke an undocumented hidden function (CWE-912) to execute arbitrary OS commands, giving full control of the appliance with high confidentiality, integrity, and availability impact. Firmware versions below 02.01.15 are affected and a vendor fix is available. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor/JVN rates the issue CVSS 4.0 8.7 (PR:L, UI:N).
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Unauthorized BLE command injection against the Pulsetto Vagus Nerve Stimulator firmware allows any physically proximate attacker to invoke hidden device commands without authentication or encryption, with potential to alter stimulation parameters or disrupt device operation. The firmware processes a set of undisclosed commands - never exposed through the official companion mobile application - whenever the device is powered on and advertising over BLE, presenting a zero-authentication attack surface at the radio layer. No public exploit code has been identified at time of analysis, but the adjacent-only, no-authentication requirement makes opportunistic abuse practical in any clinical or public setting where patients wear the device.
Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. Reported by WPScan; no public exploit is identified and the issue is not listed in CISA KEV at time of analysis, though the delivery mechanism means the implant is effectively pre-planted rather than requiring an active attack against each target.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Supply-chain compromise of MonsterInsights Pro, a widely used WordPress Google Analytics plugin, delivered a malicious file (class-system-check.php) through the vendor's own S3 update bucket (monster-insights.s3.amazonaws.com). Both the current release (10.2.2) and the 10.2.0 build the vendor rolled back to are trojaned, so administrators who updated - or downgraded to remediate - received attacker-controlled PHP that runs with full site privileges. WPScan reports the attacker still holds write access to the bucket and was iterating on three AES-256-GCM payload variants on 2026-06-11; there is no CISA KEV listing and no public exploit code, but the malicious distribution is described as active and ongoing by the reporter.