Router
Monthly
Command injection in ASUS router firmware lets an unauthenticated attacker on an adjacent network segment execute arbitrary commands with root privileges, but only while the device is still in its factory-default, unconfigured state. Per the vendor-sourced advisory and the assessed vector, authentication is not required and no user interaction is needed, so any reachable router that has not completed initial setup is exposed to devices on the same LAN/Wi-Fi segment; internet-facing exploitation is not implied. The exact vulnerable parameter and endpoint are not described in the available sources, no public exploit code has been identified at time of analysis, and the vendor points to the 'Security Update for ASUS Router Firmware' section of its advisory for fix guidance.
Improper authentication in ASUS router firmware lets an unauthenticated attacker on an adjacent network-such as an associated Wi-Fi client or a device on the same LAN segment-send an HTTP request, forge an access ticket, and perform administrator operations. The affected router models and firmware versions are not specified in the available data, which uses a wildcard CPE for ASUS routers, and no public exploit has been identified at time of analysis. The issue is rated 8.7 and is prioritized this week.
OS command injection chained with cross-site request forgery in ASUS router firmware allows an attacker to execute arbitrary commands with root privileges on the device by luring an administrator who is already logged in to the web management interface into visiting a phishing page. Rated CVSS 4.0 8.6 (high) and tracked as CWE-78, the flaw requires no credentials of the attacker's own (PR:N) but depends on user interaction (UI:A) with a valid authenticated administrator session on the victim side, which is the primary limiting precondition. It was reported to the CNA by ASUS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the specific affected models, firmware versions and vulnerable endpoint are not enumerated in the available sources, which instead point to the vendor's security advisory for fixed firmware.
Reflected cross-site scripting in TanStack Start server functions lets an unauthenticated attacker craft a server-function URL that causes the application's own origin to return attacker-controlled HTML, which executes in the browser of any visitor who opens that URL and can then read same-origin data or issue requests with the victim's authority. The flaw affects @tanstack/start-server-core from 1.143.12 through versions before 1.169.39, plus @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56 (TanStack Router before release-2026-09-30-1747). Exploitation is unauthenticated (PR:N) but requires victim interaction (UI:R) - the target must open the attacker-supplied URL - and no public exploit code or active exploitation has been identified at time of analysis, so the 9.3 score reflects the high confidentiality and integrity impact of the same-origin script injection rather than confirmed in-the-wild attacks.
Cross-site scripting in ASUS router web-management modules lets a remote, unauthenticated attacker read DOM information from the administrator's browser session, modify router settings, and drive the device into a denial-of-service condition when a logged-in administrator is induced to visit a crafted URL. The vendor assigns this CWE-79 flaw a CVSS 4.0 base score of 9.3 (Critical), and the weakness affects ASUS router firmware generally per the wildcard CPE, with no specific model or firmware versions enumerated in the available data. Successful exploitation still depends on social engineering and on a legitimate administrator being actively authenticated to the management interface at the time the link is opened; no public exploit code was identified at time of analysis and no EPSS score or CISA KEV listing is present in the source data.
Derivation of IFTTT pairing tokens in the ASUS RT-BE57 router allows an unauthenticated attacker within adjacent wireless range to read or modify router settings, provided they can observe a live administrator-initiated IFTTT pairing exchange. The root cause is a predictable seed in the pairing-token PRNG (CWE-337), which lets the attacker reconstruct the token from values emitted during that session; the assessed CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H) reflects full impact to router confidentiality, integrity, and availability but heavily conditioned on adjacency, high attack complexity, and a present attack requirement. Exploitation is therefore opportunistic rather than on-demand and only affects deployments where IFTTT integration is actually used; no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.
Certain ASUS router models write DDNS (dynamic DNS) account credentials into the readable system log, so an attacker who already holds high-privilege administrative access and sits on the same or an adjacent network segment (LAN/Wi-Fi) can harvest those secrets from the log and potentially redirect DNS settings. The exposure is confirmed by the vendor (ASUS) and rated 8.4 High under CVSS 4.0, but the prerequisite of authenticated management access plus network adjacency makes it a context-dependent, moderate-priority issue rather than a mass-exploitable one; no public exploit code has been identified at time of analysis and no CISA KEV listing applies. The leak only yields credentials on devices where DDNS is actually configured and enabled.
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management interface to enable the normally-disabled Telnet service via a crafted HTTP request, then execute arbitrary commands with root privileges on the router and potentially pivot to other devices on the same network. The flaw requires valid administrative credentials and a non-trivial request (vendor CVSS 4.0 8.9, AV:N/AC:H/PR:H), but once triggered it yields full root-level control with a scope change because the compromised router can be used to attack connected devices. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); ASUS has published a firmware remediation section in its security advisory.
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file through the web-based management interface that is subsequently processed with an attacker-influenced format string by a vulnerable router module (CWE-134). The vendor's CVSS 4.0 score of 9.4 (Critical) reflects complete loss of confidentiality, integrity, and availability on the vulnerable component plus a scope change, but exploitation is gated by a pre-existing high-privilege administrator session per the PR:H vector metric, so exposure depends on whether the management interface is reachable by the attacker (WAN-exposed remote administration versus LAN-only) and on the strength of admin credentials. No public exploit code and no confirmed active exploitation have been identified at time of analysis, no EPSS score was supplied, and the wildcard CPE (cpe:2.3:a:asus:router:*:*:*:*:*:*:*:*) means specific affected models and firmware builds are not enumerated in the available data.
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.
A stack-based buffer overflow in the FAST FAC1203R router firmware (version 20200116_2.0.4) is reachable through the MmtAtePrase parser inside the _tWlanTask function, letting an attacker on the same LAN or WiFi segment send crafted input that corrupts the stack and can lead to full compromise of the device (assessed CVSS:3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H). No authentication or user interaction is required once the attacker has local network adjacency, so the realistic exposure is confined to attackers who can join or reach the local network rather than the general internet. Publicly available exploit code exists and a proof-of-concept repository has been published, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis, and the vendor did not respond to disclosure, so no vendor patch is currently identified.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote attacker to corrupt memory and potentially achieve code execution on the device by supplying a manipulated 'opt' argument to the menu_nat_more.asp endpoint handled by the menu_nat_more_asp function. The flaw is remotely reachable with low attack complexity and no user interaction, but exploitation requires valid admin-level credentials (CVSS PR:H) plus network reachability of the Web Administration Service, which is normally confined to the LAN unless remote management is enabled. Publicly available exploit code exists - a Python PoC and a technical write-up are published on GitHub - but there is no confirmation of active exploitation (no CISA KEV listing), and only firmware 16.07 is confirmed affected.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
Unauthenticated access to the backup function on the Kaon AR2140X router allows an attacker on an adjacent network segment to trigger a configuration export without any credentials and download the resulting file, which is protected only by a device-specific encryption key. The same action drives the router into an inoperable state for a substantial period, making availability loss the dominant realistic impact, while the device-specific backup encryption limits direct confidentiality exposure. Affected firmware is reported up to version 4.2.17, with the status of newer releases unknown; exploitation requires network adjacency (same LAN, Wi-Fi, or adjacent ISP access segment) rather than internet exposure, no authentication or user interaction is needed, and no public exploit code was identified at time of analysis.
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. Exploitation is not confirmed as active (no CISA KEV entry), and the vendor was contacted early but never responded, so no official patch has been identified.
Stack-based buffer overflow in the MmtAtePrase parser of the twlantask component on FAST FAC1200R routers running firmware 5.0_20201119_1.0.2 allows an attacker who already holds valid credentials for the device management interface to send crafted input that overwrites stack memory, with the potential for arbitrary code execution or device crash/reboot. Exploitation is network-reachable but gated by authentication (CVSS PR:L) and by the fact that this router's management interface is normally LAN-only, so WAN-side attacks depend on non-default remote-management configuration. A publicly available exploit exists (published proof-of-concept code referencing the twlantask MmtAtePrase overflow), and the vendor was contacted but did not respond, so no vendor patch is available; the flaw is not known to be actively exploited in the wild. The vendor score of 8.6 overstates real-world risk given the narrow affected build, the sub-brand's limited deployment base, and the authentication prerequisite.
Stack-based buffer overflow in the devdiscover service of the FAST FAC1200R router running firmware 5.0_20201119_1.0.2 allows an attacker who can reach the device-discovery endpoint to overwrite stack memory with a crafted advertisement frame, with the assessed impact being full loss of confidentiality, integrity and availability (remote-code-execution class, CWE-121). Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch has been identified at time of analysis. The vendor-supplied CVSS 4.0 vector specifies PR:L, so some level of privilege or authentication is presumed to be required even though the advisory text does not confirm the exact prerequisite, and no CISA KEV entry indicates that this is currently being exploited in the wild.
Unauthenticated stack-based buffer overflow in Buffalo WSR-300HP routers and WEX-G300 Wi-Fi extenders allows network-adjacent attackers to crash devices via crafted HTTP requests, causing denial-of-service. Exploitation requires network access to the HTTP management interface, typically only reachable from the local network unless remote administration is exposed to the WAN. No public exploit code or confirmed active exploitation (CISA KEV) has been identified, and the issue is assessed as genuine but low-priority due to reachability constraints.
Authenticated command injection in BUFFALO WSR-300HP wireless routers and WEX-G300 range extenders lets a user who already holds administrative access to the device's web management interface execute arbitrary operating system commands by submitting a crafted HTTP request to a web form field. Successful exploitation yields full compromise of the device (confidentiality, integrity and availability all rated High), but the attack is gated behind valid admin credentials or an active admin session, which is the dominant risk-limiting factor, and the affected models are primarily Japanese consumer/SOHO devices. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor CVSS 4.0 score of 8.6 reflects impact severity once the prerequisite administrative access is met.
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-privilege user execute arbitrary shell commands on the device by manipulating the 'url' argument passed to the Tools Ping Handler in /usr/bin/network_tools. Exploitation is network-reachable, requires no user interaction, and publicly available exploit code exists (a proof-of-concept write-up is hosted on GitHub), so any NBR200V2 whose management/diagnostics interface is reachable and whose credentials are known, guessable, or left at default should be considered at immediate risk. The vendor was contacted early but did not respond, and no fixed firmware has been identified, so no CISA KEV active-exploitation entry is associated with this issue at time of analysis. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the device itself.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.
Remote command execution in certain ASUS router firmware allows a network man-in-the-middle attacker to force the router to download and run arbitrary commands from a spoofed update/download server. The root cause is a failure to validate both the integrity check value (CWE-354) and the TLS server certificate, so an attacker positioned in the network path can impersonate a legitimate ASUS server. No public exploit identified at time of analysis and the flaw is not in CISA KEV; ASUS self-reported it and rates it critical (CVSS 4.0 9.5), though exploitation requires the attacker to first achieve a MITM position (AT:P).
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.
Command injection in TRENDnet Router firmware 1.1.02b01 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `wan_type` parameter in the `/cgi-bin/ping.cgi` endpoint. A publicly available proof-of-concept exploit (hosted on GitHub) lowers the technical bar for exploitation. The provided CVSS 4.0 score of 2.1 with low impact metrics is notably inconsistent with typical command injection severity and warrants independent verification against actual privilege boundaries of the CGI process.
SQL injection in the web management interface of multiple ASUS router models enables a remotely authenticated, high-privilege user to exfiltrate confidential information by sending crafted requests that bypass the router's existing input validation. The vulnerability is limited to read-only data disclosure (no integrity or availability impact) and requires prior administrative authentication, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high complexity and authentication prerequisites.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Web management interface of ASUS router models that allows an unauthenticated attacker to perform actions with the privileges of an authenticated administrator, potentially including arbitrary system command execution. The vulnerability affects ASUS router products across multiple versions due to insufficient CSRF token validation in the web interface. While no CVSS score or EPSS data is currently available, the ability to execute system commands on a network-critical device represents a critical severity threat.
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows authenticated remote attackers to crash or potentially execute code on the device by sending an oversized 'Profile' argument to /goform/formRemoteControl. Exploitation requires network reachability to the router's admin web UI plus valid low-privileged credentials (the CVSS vectors for both the NVD 4.0 score and the independent 3.1 assessment specify PR:L), and publicly available exploit code exists, though there is no evidence of active exploitation (CISA KEV does not list this CVE) and EPSS is only 0.04% (11th percentile). The vendor was contacted early but never responded, so no patch has been released, and real-world risk is low despite the 7.4 CVSS 4.0 score because the product is obscure, low-deployment, and the attack is gated behind authentication.
Stack-based buffer overflow in the Tenda FH1201 SOHO router running firmware 1.2.0.14(408) lets an authenticated remote attacker corrupt memory by sending an oversized 'page' parameter to the /goform/SetIpBind endpoint, which is passed unsafely into sprintf. Successful exploitation can yield full loss of confidentiality, integrity, and availability on the device (assessed CVSS 3.1 base 8.8-style impact, vendor/VulDB score 7.4), though the attacker must first reach the web management interface, which is normally LAN-bound, and hold a low-privilege authenticated session (PR:L). Publicly available exploit code exists (a GitHub PoC with reproduction steps), so weaponization is straightforward for anyone who can obtain panel access; there is no CISA KEV listing, so active exploitation is not confirmed from the supplied data.
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
Unauthenticated OS command injection in the WODESYS WD-R608U small-office/home-office router (sold as WDR122B V2.0 and WDR28) allows an attacker positioned on the same LAN or Wi-Fi segment to execute arbitrary system shell commands through the langGet parameter of the adm.cgi web management endpoint. No credentials or user interaction are required - the injected input is passed to a system shell without validation - but exploitation is gated by adjacent-network positioning and by the admin interface being reachable, so the exposure is not internet-scale unless management access has been deliberately published. Only firmware WDR28081123OV1.01 was tested and confirmed vulnerable; the vendor did not respond with a vulnerability or version-range statement, so additional versions may also be affected. No vendor-released patch has been identified, and no public exploit code was identified at the time of analysis; EPSS is 2.70% (85th percentile), reflecting elevated but not top-tier exploitation likelihood.
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B20230113 by abusing an authorization bypass in the cstecgi.cgi endpoint, and then log in as root using a blank password on factory-reset devices, yielding arbitrary command execution. Publicly available exploit code exists (a detailed write-up is referenced by NVD), and EPSS places this at roughly 11.28% (96th percentile), indicating elevated real-world interest, though there is no CISA KEV confirmation of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the bypass is fully unauthenticated and requires no user interaction; risk is highest where the router's web management interface is reachable from the WAN or an untrusted network.
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Command injection in ASUS router firmware lets an unauthenticated attacker on an adjacent network segment execute arbitrary commands with root privileges, but only while the device is still in its factory-default, unconfigured state. Per the vendor-sourced advisory and the assessed vector, authentication is not required and no user interaction is needed, so any reachable router that has not completed initial setup is exposed to devices on the same LAN/Wi-Fi segment; internet-facing exploitation is not implied. The exact vulnerable parameter and endpoint are not described in the available sources, no public exploit code has been identified at time of analysis, and the vendor points to the 'Security Update for ASUS Router Firmware' section of its advisory for fix guidance.
Improper authentication in ASUS router firmware lets an unauthenticated attacker on an adjacent network-such as an associated Wi-Fi client or a device on the same LAN segment-send an HTTP request, forge an access ticket, and perform administrator operations. The affected router models and firmware versions are not specified in the available data, which uses a wildcard CPE for ASUS routers, and no public exploit has been identified at time of analysis. The issue is rated 8.7 and is prioritized this week.
OS command injection chained with cross-site request forgery in ASUS router firmware allows an attacker to execute arbitrary commands with root privileges on the device by luring an administrator who is already logged in to the web management interface into visiting a phishing page. Rated CVSS 4.0 8.6 (high) and tracked as CWE-78, the flaw requires no credentials of the attacker's own (PR:N) but depends on user interaction (UI:A) with a valid authenticated administrator session on the victim side, which is the primary limiting precondition. It was reported to the CNA by ASUS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the specific affected models, firmware versions and vulnerable endpoint are not enumerated in the available sources, which instead point to the vendor's security advisory for fixed firmware.
Reflected cross-site scripting in TanStack Start server functions lets an unauthenticated attacker craft a server-function URL that causes the application's own origin to return attacker-controlled HTML, which executes in the browser of any visitor who opens that URL and can then read same-origin data or issue requests with the victim's authority. The flaw affects @tanstack/start-server-core from 1.143.12 through versions before 1.169.39, plus @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56 (TanStack Router before release-2026-09-30-1747). Exploitation is unauthenticated (PR:N) but requires victim interaction (UI:R) - the target must open the attacker-supplied URL - and no public exploit code or active exploitation has been identified at time of analysis, so the 9.3 score reflects the high confidentiality and integrity impact of the same-origin script injection rather than confirmed in-the-wild attacks.
Cross-site scripting in ASUS router web-management modules lets a remote, unauthenticated attacker read DOM information from the administrator's browser session, modify router settings, and drive the device into a denial-of-service condition when a logged-in administrator is induced to visit a crafted URL. The vendor assigns this CWE-79 flaw a CVSS 4.0 base score of 9.3 (Critical), and the weakness affects ASUS router firmware generally per the wildcard CPE, with no specific model or firmware versions enumerated in the available data. Successful exploitation still depends on social engineering and on a legitimate administrator being actively authenticated to the management interface at the time the link is opened; no public exploit code was identified at time of analysis and no EPSS score or CISA KEV listing is present in the source data.
Derivation of IFTTT pairing tokens in the ASUS RT-BE57 router allows an unauthenticated attacker within adjacent wireless range to read or modify router settings, provided they can observe a live administrator-initiated IFTTT pairing exchange. The root cause is a predictable seed in the pairing-token PRNG (CWE-337), which lets the attacker reconstruct the token from values emitted during that session; the assessed CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H) reflects full impact to router confidentiality, integrity, and availability but heavily conditioned on adjacency, high attack complexity, and a present attack requirement. Exploitation is therefore opportunistic rather than on-demand and only affects deployments where IFTTT integration is actually used; no public exploit code has been identified at time of analysis.
A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.
Certain ASUS router models write DDNS (dynamic DNS) account credentials into the readable system log, so an attacker who already holds high-privilege administrative access and sits on the same or an adjacent network segment (LAN/Wi-Fi) can harvest those secrets from the log and potentially redirect DNS settings. The exposure is confirmed by the vendor (ASUS) and rated 8.4 High under CVSS 4.0, but the prerequisite of authenticated management access plus network adjacency makes it a context-dependent, moderate-priority issue rather than a mass-exploitable one; no public exploit code has been identified at time of analysis and no CISA KEV listing applies. The leak only yields credentials on devices where DDNS is actually configured and enabled.
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management interface to enable the normally-disabled Telnet service via a crafted HTTP request, then execute arbitrary commands with root privileges on the router and potentially pivot to other devices on the same network. The flaw requires valid administrative credentials and a non-trivial request (vendor CVSS 4.0 8.9, AV:N/AC:H/PR:H), but once triggered it yields full root-level control with a scope change because the compromised router can be used to attack connected devices. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); ASUS has published a firmware remediation section in its security advisory.
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file through the web-based management interface that is subsequently processed with an attacker-influenced format string by a vulnerable router module (CWE-134). The vendor's CVSS 4.0 score of 9.4 (Critical) reflects complete loss of confidentiality, integrity, and availability on the vulnerable component plus a scope change, but exploitation is gated by a pre-existing high-privilege administrator session per the PR:H vector metric, so exposure depends on whether the management interface is reachable by the attacker (WAN-exposed remote administration versus LAN-only) and on the strength of admin credentials. No public exploit code and no confirmed active exploitation have been identified at time of analysis, no EPSS score was supplied, and the wildcard CPE (cpe:2.3:a:asus:router:*:*:*:*:*:*:*:*) means specific affected models and firmware builds are not enumerated in the available data.
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.
A stack-based buffer overflow in the FAST FAC1203R router firmware (version 20200116_2.0.4) is reachable through the MmtAtePrase parser inside the _tWlanTask function, letting an attacker on the same LAN or WiFi segment send crafted input that corrupts the stack and can lead to full compromise of the device (assessed CVSS:3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H). No authentication or user interaction is required once the attacker has local network adjacency, so the realistic exposure is confined to attackers who can join or reach the local network rather than the general internet. Publicly available exploit code exists and a proof-of-concept repository has been published, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis, and the vendor did not respond to disclosure, so no vendor patch is currently identified.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote attacker to corrupt memory and potentially achieve code execution on the device by supplying a manipulated 'opt' argument to the menu_nat_more.asp endpoint handled by the menu_nat_more_asp function. The flaw is remotely reachable with low attack complexity and no user interaction, but exploitation requires valid admin-level credentials (CVSS PR:H) plus network reachability of the Web Administration Service, which is normally confined to the LAN unless remote management is enabled. Publicly available exploit code exists - a Python PoC and a technical write-up are published on GitHub - but there is no confirmation of active exploitation (no CISA KEV listing), and only firmware 16.07 is confirmed affected.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
Unauthenticated access to the backup function on the Kaon AR2140X router allows an attacker on an adjacent network segment to trigger a configuration export without any credentials and download the resulting file, which is protected only by a device-specific encryption key. The same action drives the router into an inoperable state for a substantial period, making availability loss the dominant realistic impact, while the device-specific backup encryption limits direct confidentiality exposure. Affected firmware is reported up to version 4.2.17, with the status of newer releases unknown; exploitation requires network adjacency (same LAN, Wi-Fi, or adjacent ISP access segment) rather than internet exposure, no authentication or user interaction is needed, and no public exploit code was identified at time of analysis.
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. Exploitation is not confirmed as active (no CISA KEV entry), and the vendor was contacted early but never responded, so no official patch has been identified.
Stack-based buffer overflow in the MmtAtePrase parser of the twlantask component on FAST FAC1200R routers running firmware 5.0_20201119_1.0.2 allows an attacker who already holds valid credentials for the device management interface to send crafted input that overwrites stack memory, with the potential for arbitrary code execution or device crash/reboot. Exploitation is network-reachable but gated by authentication (CVSS PR:L) and by the fact that this router's management interface is normally LAN-only, so WAN-side attacks depend on non-default remote-management configuration. A publicly available exploit exists (published proof-of-concept code referencing the twlantask MmtAtePrase overflow), and the vendor was contacted but did not respond, so no vendor patch is available; the flaw is not known to be actively exploited in the wild. The vendor score of 8.6 overstates real-world risk given the narrow affected build, the sub-brand's limited deployment base, and the authentication prerequisite.
Stack-based buffer overflow in the devdiscover service of the FAST FAC1200R router running firmware 5.0_20201119_1.0.2 allows an attacker who can reach the device-discovery endpoint to overwrite stack memory with a crafted advertisement frame, with the assessed impact being full loss of confidentiality, integrity and availability (remote-code-execution class, CWE-121). Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch has been identified at time of analysis. The vendor-supplied CVSS 4.0 vector specifies PR:L, so some level of privilege or authentication is presumed to be required even though the advisory text does not confirm the exact prerequisite, and no CISA KEV entry indicates that this is currently being exploited in the wild.
Unauthenticated stack-based buffer overflow in Buffalo WSR-300HP routers and WEX-G300 Wi-Fi extenders allows network-adjacent attackers to crash devices via crafted HTTP requests, causing denial-of-service. Exploitation requires network access to the HTTP management interface, typically only reachable from the local network unless remote administration is exposed to the WAN. No public exploit code or confirmed active exploitation (CISA KEV) has been identified, and the issue is assessed as genuine but low-priority due to reachability constraints.
Authenticated command injection in BUFFALO WSR-300HP wireless routers and WEX-G300 range extenders lets a user who already holds administrative access to the device's web management interface execute arbitrary operating system commands by submitting a crafted HTTP request to a web form field. Successful exploitation yields full compromise of the device (confidentiality, integrity and availability all rated High), but the attack is gated behind valid admin credentials or an active admin session, which is the dominant risk-limiting factor, and the affected models are primarily Japanese consumer/SOHO devices. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor CVSS 4.0 score of 8.6 reflects impact severity once the prerequisite administrative access is met.
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-privilege user execute arbitrary shell commands on the device by manipulating the 'url' argument passed to the Tools Ping Handler in /usr/bin/network_tools. Exploitation is network-reachable, requires no user interaction, and publicly available exploit code exists (a proof-of-concept write-up is hosted on GitHub), so any NBR200V2 whose management/diagnostics interface is reachable and whose credentials are known, guessable, or left at default should be considered at immediate risk. The vendor was contacted early but did not respond, and no fixed firmware has been identified, so no CISA KEV active-exploitation entry is associated with this issue at time of analysis. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the device itself.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.
Remote command execution in certain ASUS router firmware allows a network man-in-the-middle attacker to force the router to download and run arbitrary commands from a spoofed update/download server. The root cause is a failure to validate both the integrity check value (CWE-354) and the TLS server certificate, so an attacker positioned in the network path can impersonate a legitimate ASUS server. No public exploit identified at time of analysis and the flaw is not in CISA KEV; ASUS self-reported it and rates it critical (CVSS 4.0 9.5), though exploitation requires the attacker to first achieve a MITM position (AT:P).
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.
Command injection in TRENDnet Router firmware 1.1.02b01 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `wan_type` parameter in the `/cgi-bin/ping.cgi` endpoint. A publicly available proof-of-concept exploit (hosted on GitHub) lowers the technical bar for exploitation. The provided CVSS 4.0 score of 2.1 with low impact metrics is notably inconsistent with typical command injection severity and warrants independent verification against actual privilege boundaries of the CGI process.
SQL injection in the web management interface of multiple ASUS router models enables a remotely authenticated, high-privilege user to exfiltrate confidential information by sending crafted requests that bypass the router's existing input validation. The vulnerability is limited to read-only data disclosure (no integrity or availability impact) and requires prior administrative authentication, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high complexity and authentication prerequisites.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Web management interface of ASUS router models that allows an unauthenticated attacker to perform actions with the privileges of an authenticated administrator, potentially including arbitrary system command execution. The vulnerability affects ASUS router products across multiple versions due to insufficient CSRF token validation in the web interface. While no CVSS score or EPSS data is currently available, the ability to execute system commands on a network-critical device represents a critical severity threat.
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows authenticated remote attackers to crash or potentially execute code on the device by sending an oversized 'Profile' argument to /goform/formRemoteControl. Exploitation requires network reachability to the router's admin web UI plus valid low-privileged credentials (the CVSS vectors for both the NVD 4.0 score and the independent 3.1 assessment specify PR:L), and publicly available exploit code exists, though there is no evidence of active exploitation (CISA KEV does not list this CVE) and EPSS is only 0.04% (11th percentile). The vendor was contacted early but never responded, so no patch has been released, and real-world risk is low despite the 7.4 CVSS 4.0 score because the product is obscure, low-deployment, and the attack is gated behind authentication.
Stack-based buffer overflow in the Tenda FH1201 SOHO router running firmware 1.2.0.14(408) lets an authenticated remote attacker corrupt memory by sending an oversized 'page' parameter to the /goform/SetIpBind endpoint, which is passed unsafely into sprintf. Successful exploitation can yield full loss of confidentiality, integrity, and availability on the device (assessed CVSS 3.1 base 8.8-style impact, vendor/VulDB score 7.4), though the attacker must first reach the web management interface, which is normally LAN-bound, and hold a low-privilege authenticated session (PR:L). Publicly available exploit code exists (a GitHub PoC with reproduction steps), so weaponization is straightforward for anyone who can obtain panel access; there is no CISA KEV listing, so active exploitation is not confirmed from the supplied data.
Stack-based buffer overflow in the Tenda AC18 router firmware version 15.03.05.05 allows an attacker to corrupt memory through the scanList parameter handled by the sprintf call in /goform/SetDlnaCfg, potentially leading to code execution or a crash of the device's HTTP management service. The vulnerability requires network reachability to the router's web management interface and low-privilege authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N), so practical exposure is normally limited to the LAN unless remote/WAN management has been explicitly enabled. Publicly available exploit code exists, including a published proof-of-concept with reproduction steps, and no vendor-released patch has been identified at time of analysis; EPSS and CISA KEV do not indicate confirmed active exploitation.
Unauthenticated OS command injection in the WODESYS WD-R608U small-office/home-office router (sold as WDR122B V2.0 and WDR28) allows an attacker positioned on the same LAN or Wi-Fi segment to execute arbitrary system shell commands through the langGet parameter of the adm.cgi web management endpoint. No credentials or user interaction are required - the injected input is passed to a system shell without validation - but exploitation is gated by adjacent-network positioning and by the admin interface being reachable, so the exposure is not internet-scale unless management access has been deliberately published. Only firmware WDR28081123OV1.01 was tested and confirmed vulnerable; the vendor did not respond with a vulnerability or version-range statement, so additional versions may also be affected. No vendor-released patch has been identified, and no public exploit code was identified at the time of analysis; EPSS is 2.70% (85th percentile), reflecting elevated but not top-tier exploitation likelihood.
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B20230113 by abusing an authorization bypass in the cstecgi.cgi endpoint, and then log in as root using a blank password on factory-reset devices, yielding arbitrary command execution. Publicly available exploit code exists (a detailed write-up is referenced by NVD), and EPSS places this at roughly 11.28% (96th percentile), indicating elevated real-world interest, though there is no CISA KEV confirmation of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the bypass is fully unauthenticated and requires no user interaction; risk is highest where the router's web management interface is reachable from the WAN or an untrusted network.
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.