Firmware
Monthly
Decryption of sensitive diagnostics bundles in AJA HELO Plus firmware before 2.1.7 allows unauthenticated remote attackers to recover highly sensitive server information from any device they can reach. The firmware embeds a static AES passphrase in obfuscated form, so an attacker who reverse engineers the publicly available firmware image once can decrypt diagnostics exports pulled from the unauthenticated diagnostics endpoint on every affected device. Exploitation requires no authentication, no user interaction, and no non-default configuration, with network reachability to the device's management/diagnostics interface as the primary limiting factor; no public exploit code has been identified at time of analysis, and a vendor fix is available in firmware 2.1.7.
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Path traversal in the WatchGuard Fireware OS WebUI management agent lets an authenticated administrator read or list arbitrary files on the local filesystem by submitting a specially crafted management request. Exploitation requires valid WebUI administrator credentials (the highest management privilege on the Firebox), per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so the flaw is remote and low-complexity once the attacker already holds admin access, and the impact is limited to confidentiality (file read/list) with no write, code execution, or availability effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor advisory is published at https://psirt.watchguard.com/CVE-2026-13224 and no EPSS score was provided in the available data.
Denial of service of the diagnostic-tools subsystem in WatchGuard Fireware OS can be triggered by a low-privileged, authenticated user who repeatedly starts and aborts a specially crafted diagnostic task through the management web UI. The authentication requirement (PR:L per the supplied vector) and the subsystem-confined blast radius, which does not reach the firewall's core traffic-processing functions, keep this a genuine but modest-priority issue rather than a device-wide outage; no public exploit code has been identified at time of analysis and no KEV listing is present in the intelligence. Note that the vendor's CVSS 4.0 score of 7.1 records high availability impact (VA:H) on the product, while our independent assessment scores availability as low (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because the resource exhaustion is limited to the diagnostic tooling.
Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. No public exploit code, PoC, or confirmed in-the-wild exploitation was identified at the time of analysis, but the combination of an exposed trust anchor and a signature-verification bypass makes this a genuine high-impact integrity flaw rather than an inflated score.
Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, covering G526, G526RP, G527 and G528 models) can be tampered with so that a stored value is later served by the management interface as JSON and rendered as raw HTML by the update-information web page, allowing attacker-controlled script to run in an authenticated administrator's browser. Because the same authenticated origin also exposes an interface that executes system-level commands with root privileges, an attacker who can inject metadata can escalate from script execution to arbitrary code execution in the device's administrative context. The vendor-assigned CVSS 4.0 base score is 7.7, but the attack is not opportunistic: it requires an on-path/adversary-in-the-middle position against the unencrypted update channel (AT:P) and an administrator who opens the affected page (UI:P), and no public exploit code or confirmed active exploitation was identified at time of analysis - the issue was reported through CISA's ICS coordination process (ICSA-26-272-01).
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
Information disclosure in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows an authenticated, low-privilege user (CVSS vector PR:L) to reach two user-information endpoints that expose sensitive device and account details. The leak is not reproducible in normal operation - it appears only in a non-default, misconfigured, or transient device state - and it is a confidentiality-only exposure in the independent assessment (C:H/I:N/A:N), even though CISA, scoring on behalf of the vendor, assigned a CVSS 4.0 base of 8.7 that also claims high integrity and availability impact. There is no public exploit identified at time of analysis (no CISA KEV listing, no POC reference in the advisory data), and the affected product is a niche RTMP/H5 IoT camera with limited deployment, which constrains real-world risk.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unverified firmware images to the device and take full control of it, because both the local and the cloud update paths validate only a basic hash instead of a cryptographic signature. The flaw is a design-level chain-of-trust failure (CWE-347) scored 8.7 under CVSS 4.0, and per the associated CVSS vector it requires low-level privileges (PR:L) with no user interaction (UI:N) while impacting confidentiality, integrity and availability equally. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so practical urgency is driven mainly by device exposure; real-world risk is further bounded by Anjvision's very small deployment footprint.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.
Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any external user to run arbitrary code inside the project's trusted CI context prior to firmware 2.7.21.1370b23. Because main_matrix.yml (and related workflows) triggered on pull_request_target while the check, build, and build-debian-src jobs checked out and executed code from the attacker's fork with no approval gate, a pull request from an author_association of NONE automatically ran attacker-controlled files with access to repository secrets and an elevated GITHUB_TOKEN. This is CWE-94 code injection scoring CVSS 10.0; no public exploit identified at time of analysis, though a linked Google Drive writeup may contain proof-of-concept detail.
Authentication bypass in Tenda router firmware (AC10, AC5, AC6, FH1201, W15E) lets any user log in as administrator via a hidden vendor backdoor: after normal MD5-based login fails, the /bin/httpd login() routine at 0x4c88b8 falls back to a plaintext strcmp() against the 'sys.rzadmin.password' config value, granting role=2 (admin) with any username. Reported through CERT/CC (VU#213560), it is not in CISA KEV and has no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile). The flaw is a classic CWE-912 hidden-functionality backdoor mapped to CVSS 9.8.
Anonymous MQTT access in Yarbo firmware v2.3.9 allows remote unauthenticated attackers on the local network to fully control the robotic lawn mower and exfiltrate sensitive telemetry data. The embedded MQTT broker accepts connections without credentials and enforces no topic-level access controls, enabling arbitrary publish/subscribe operations. No authentication, authorization, or message validation occurs. EPSS and KEV data not available; exploitation requires only network access to the robot's MQTT port (typically TCP 1883).
Hardcoded administrative credentials in Yarbo firmware v2.3.9 allow remote unauthenticated attackers to gain full device administrative access across all deployed units. The CVSS 9.8 critical score reflects the complete lack of authentication barriers (AV:N/AC:L/PR:N), with identical credentials embedded in every device that cannot be changed by end users. No active exploitation has been confirmed by CISA KEV, but a public GitHub repository reference suggests potential proof-of-concept availability. EPSS data unavailable, though the trivial exploitation path (no complexity, no privileges required) indicates high weaponization potential once credentials become widely known.
Undocumented persistent backdoor in Yarbo firmware v2.3.9 grants remote privileged access that survives factory reset and firmware updates. The backdoor requires high-privilege authentication (CVSS PR:H) but provides complete system control once accessed. No public exploit identified at time of analysis, though GitHub repository reference suggests technical disclosure exists. CVSS 7.2 reflects the high-privilege requirement, but persistence across resets and undocumented nature indicate significant supply chain or insider threat risk.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
Authorization bypass in the WatchGuard Fireware OS Access Portal reverse proxy lets an authenticated, low-privileged portal user reach back-end web applications they are not entitled to by sending a specially crafted request for a resource they are authorized to access. Exploitation requires valid Access Portal credentials, the SSL clientless portal to be enabled and reachable, and a specific crafted-request condition (CVSS 4.0 AT:P), so this is a genuine but bounded access-control flaw rather than a pre-auth compromise path. Impact is primarily confidentiality: unauthorized read of other portal-published web applications, with limited integrity effects and no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service (disconnect all wifi clients) via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 20.9%.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin for the admin account and (2) compalbn for the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.6%.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.4%.
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.8%.
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote attackers to hijack the authentication of administrators for. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Decryption of sensitive diagnostics bundles in AJA HELO Plus firmware before 2.1.7 allows unauthenticated remote attackers to recover highly sensitive server information from any device they can reach. The firmware embeds a static AES passphrase in obfuscated form, so an attacker who reverse engineers the publicly available firmware image once can decrypt diagnostics exports pulled from the unauthenticated diagnostics endpoint on every affected device. Exploitation requires no authentication, no user interaction, and no non-default configuration, with network reachability to the device's management/diagnostics interface as the primary limiting factor; no public exploit code has been identified at time of analysis, and a vendor fix is available in firmware 2.1.7.
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Path traversal in the WatchGuard Fireware OS WebUI management agent lets an authenticated administrator read or list arbitrary files on the local filesystem by submitting a specially crafted management request. Exploitation requires valid WebUI administrator credentials (the highest management privilege on the Firebox), per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so the flaw is remote and low-complexity once the attacker already holds admin access, and the impact is limited to confidentiality (file read/list) with no write, code execution, or availability effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor advisory is published at https://psirt.watchguard.com/CVE-2026-13224 and no EPSS score was provided in the available data.
Denial of service of the diagnostic-tools subsystem in WatchGuard Fireware OS can be triggered by a low-privileged, authenticated user who repeatedly starts and aborts a specially crafted diagnostic task through the management web UI. The authentication requirement (PR:L per the supplied vector) and the subsystem-confined blast radius, which does not reach the firewall's core traffic-processing functions, keep this a genuine but modest-priority issue rather than a device-wide outage; no public exploit code has been identified at time of analysis and no KEV listing is present in the intelligence. Note that the vendor's CVSS 4.0 score of 7.1 records high availability impact (VA:H) on the product, while our independent assessment scores availability as low (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because the resource exhaustion is limited to the diagnostic tooling.
Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. No public exploit code, PoC, or confirmed in-the-wild exploitation was identified at the time of analysis, but the combination of an exposed trust anchor and a signature-verification bypass makes this a genuine high-impact integrity flaw rather than an inflated score.
Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, covering G526, G526RP, G527 and G528 models) can be tampered with so that a stored value is later served by the management interface as JSON and rendered as raw HTML by the update-information web page, allowing attacker-controlled script to run in an authenticated administrator's browser. Because the same authenticated origin also exposes an interface that executes system-level commands with root privileges, an attacker who can inject metadata can escalate from script execution to arbitrary code execution in the device's administrative context. The vendor-assigned CVSS 4.0 base score is 7.7, but the attack is not opportunistic: it requires an on-path/adversary-in-the-middle position against the unencrypted update channel (AT:P) and an administrator who opens the affected page (UI:P), and no public exploit code or confirmed active exploitation was identified at time of analysis - the issue was reported through CISA's ICS coordination process (ICSA-26-272-01).
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
Information disclosure in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows an authenticated, low-privilege user (CVSS vector PR:L) to reach two user-information endpoints that expose sensitive device and account details. The leak is not reproducible in normal operation - it appears only in a non-default, misconfigured, or transient device state - and it is a confidentiality-only exposure in the independent assessment (C:H/I:N/A:N), even though CISA, scoring on behalf of the vendor, assigned a CVSS 4.0 base of 8.7 that also claims high integrity and availability impact. There is no public exploit identified at time of analysis (no CISA KEV listing, no POC reference in the advisory data), and the affected product is a niche RTMP/H5 IoT camera with limited deployment, which constrains real-world risk.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unverified firmware images to the device and take full control of it, because both the local and the cloud update paths validate only a basic hash instead of a cryptographic signature. The flaw is a design-level chain-of-trust failure (CWE-347) scored 8.7 under CVSS 4.0, and per the associated CVSS vector it requires low-level privileges (PR:L) with no user interaction (UI:N) while impacting confidentiality, integrity and availability equally. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so practical urgency is driven mainly by device exposure; real-world risk is further bounded by Anjvision's very small deployment footprint.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.
Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any external user to run arbitrary code inside the project's trusted CI context prior to firmware 2.7.21.1370b23. Because main_matrix.yml (and related workflows) triggered on pull_request_target while the check, build, and build-debian-src jobs checked out and executed code from the attacker's fork with no approval gate, a pull request from an author_association of NONE automatically ran attacker-controlled files with access to repository secrets and an elevated GITHUB_TOKEN. This is CWE-94 code injection scoring CVSS 10.0; no public exploit identified at time of analysis, though a linked Google Drive writeup may contain proof-of-concept detail.
Authentication bypass in Tenda router firmware (AC10, AC5, AC6, FH1201, W15E) lets any user log in as administrator via a hidden vendor backdoor: after normal MD5-based login fails, the /bin/httpd login() routine at 0x4c88b8 falls back to a plaintext strcmp() against the 'sys.rzadmin.password' config value, granting role=2 (admin) with any username. Reported through CERT/CC (VU#213560), it is not in CISA KEV and has no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile). The flaw is a classic CWE-912 hidden-functionality backdoor mapped to CVSS 9.8.
Anonymous MQTT access in Yarbo firmware v2.3.9 allows remote unauthenticated attackers on the local network to fully control the robotic lawn mower and exfiltrate sensitive telemetry data. The embedded MQTT broker accepts connections without credentials and enforces no topic-level access controls, enabling arbitrary publish/subscribe operations. No authentication, authorization, or message validation occurs. EPSS and KEV data not available; exploitation requires only network access to the robot's MQTT port (typically TCP 1883).
Hardcoded administrative credentials in Yarbo firmware v2.3.9 allow remote unauthenticated attackers to gain full device administrative access across all deployed units. The CVSS 9.8 critical score reflects the complete lack of authentication barriers (AV:N/AC:L/PR:N), with identical credentials embedded in every device that cannot be changed by end users. No active exploitation has been confirmed by CISA KEV, but a public GitHub repository reference suggests potential proof-of-concept availability. EPSS data unavailable, though the trivial exploitation path (no complexity, no privileges required) indicates high weaponization potential once credentials become widely known.
Undocumented persistent backdoor in Yarbo firmware v2.3.9 grants remote privileged access that survives factory reset and firmware updates. The backdoor requires high-privilege authentication (CVSS PR:H) but provides complete system control once accessed. No public exploit identified at time of analysis, though GitHub repository reference suggests technical disclosure exists. CVSS 7.2 reflects the high-privilege requirement, but persistence across resets and undocumented nature indicate significant supply chain or insider threat risk.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
Authorization bypass in the WatchGuard Fireware OS Access Portal reverse proxy lets an authenticated, low-privileged portal user reach back-end web applications they are not entitled to by sending a specially crafted request for a resource they are authorized to access. Exploitation requires valid Access Portal credentials, the SSL clientless portal to be enabled and reachable, and a specific crafted-request condition (CVSS 4.0 AT:P), so this is a genuine but bounded access-control flaw rather than a pre-auth compromise path. Impact is primarily confidentiality: unauthorized read of other portal-published web applications, with limited integrity effects and no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service (disconnect all wifi clients) via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 20.9%.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin for the admin account and (2) compalbn for the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.6%.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.4%.
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.8%.
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote attackers to hijack the authentication of administrators for. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.