Authentication Bypass

Unauthenticated denial of the guest Wi-Fi service on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible because the guest_wifi_sync function performs no access control on messages arriving at the internal cs_broker MQTT component. Any attacker able to reach the broker can publish a crafted MQTT message to tear down the guest virtual AP interfaces, disrupting guest connectivity without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete diagnosis logs by sending a crafted POST request to the clearDiagnosisLog handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication, so any attacker with network reach to the web management interface can wipe diagnostic records. No public exploit identified at time of analysis and EPSS is low (0.18%), but the flaw is one of a large cluster of unauthenticated cstecgi.cgi handler weaknesses reported against this device.

Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication bypass by spoofing vulnerability (CWE-290). Any attacker holding a low-privileged account on the PowerStore management plane can exploit this network-accessible flaw without user interaction to gain full administrative control, impacting confidentiality, integrity, and availability of the storage system. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the impact of Administrator-level compromise on enterprise storage infrastructure elevates operational risk considerably.

Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).

Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Firefox's WebDriver BiDi component allows network-based attackers, with user interaction, to achieve full compromise of the browser process across confidentiality, integrity, and availability dimensions. All Mozilla Firefox versions prior to 155 are affected, as confirmed by vendor advisory mfsa2026-82 and the wildcard CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis, and SSVC confirms no observed exploitation, though CISA rates the technical impact as total.

Privilege escalation in Mozilla Firefox for Android (versions prior to 155) allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability by exploiting improper access control (CWE-284) when a user interacts with attacker-controlled content. Mozilla confirmed the fix in Firefox 155, documented under MFSA2026-82. No public exploit code exists and CISA has not added this to KEV, though SSVC rates the technical impact as 'total', underscoring the severity if successfully triggered.

Policy enforcement bypass in Kyverno v1.9.0 through v1.12.7 lets an authenticated Kubernetes user evade an enforce-mode ClusterPolicy when two overlapping PolicyExceptions apply to the same rule, because the less-restrictive exception wins. An attacker who can name a workload to match a permissive exception pattern (for example '*ingress*') can deploy resources the policy was meant to block, such as Pods with hostPath volumes. The vendor GHSA advisory (GHSA-gg4x-fgg2-h9w9) includes working reproduction manifests; there is no CISA KEV listing and no confirmed in-the-wild exploitation.

Unauthenticated disruption of scheduled live broadcasts in AVideo (all versions, CPE cpe:2.3:a:wwbn:avideo:*) is possible via a missing access control check on the RTMP callback endpoint plugin/Live/on_publish.php. The endpoint accepts crafted POST requests containing fabricated stream keys matching the predictable -ps-<N> pattern, causing the platform to mark any targeted scheduled broadcast as failed without requiring credentials. With a CVSS 4.0 score of 8.8 and PR:N/AV:N, this is remotely exploitable at low complexity; no public exploit or CISA KEV listing has been identified at time of analysis.

Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The `guest_ticket_login()` function at the publicly reachable `/sgnix/?p=<token>` endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.

Forced-reboot denial-of-service in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 enables unauthenticated network attackers to instantly restart the device by sending a crafted MQTT message to the cs_broker component's setDevReboot handler, which performs no access control check. In mesh deployments, exploiting a master node propagates the reboot command to all registered slave nodes, taking down the entire mesh network in a single unauthenticated request. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special configuration, and minimal technical complexity (CVSS AC:L, PR:N).

Unauthenticated wireless client disconnection affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), where the freeStaClient handler in the cs_broker MQTT component performs no authentication or access control on incoming messages. Any attacker able to reach the internal MQTT broker can forcibly deauthenticate/disconnect connected Wi-Fi clients (CWE-284). No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), and the input's 9.8 CVSS overstates a defect whose real-world effect is a repeatable availability disruption rather than full compromise.

Incorrect access control in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers overwrite cloud-result tracking files by publishing a crafted MQTT message to the internal cs_broker component. Because the broker accepts and acts on these messages without authenticating the sender, any actor able to reach the MQTT service can corrupt the router's cloud-check state. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.

Unauthenticated firmware-workflow abuse in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets a remote attacker start a firmware download or flash operation on a mesh slave device by publishing a crafted MQTT message to the cs_broker component. The meshSlaveUpdate handler performs no authentication or access-control check on the inbound message, so any party able to reach the broker can trigger the slave update workflow. No public exploit was identified at time of analysis, and EPSS is low (0.18%, 7th percentile).

Unauthenticated state tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite the mesh slave-IP inventory by publishing a crafted MQTT message to the cs_broker component, which performs no access control on the updateSlaveIpList function. Any attacker able to reach the MQTT broker can corrupt the router's internal record of mesh slave device addresses, disrupting mesh coordination. No public exploit has been identified and EPSS is low (0.17%), but the flaw is unauthenticated and MITRE-reported.

Incorrect access control in the recvIndirectMeshInfo function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component. The CVSS 9.8 rating reflects an unauthenticated network-facing vector, but the primary real impact is integrity (poisoning of the mesh neighbor table), with no confidentiality read and only indirect availability effect. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).

Unauthenticated firmware-update abuse in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets a remote attacker mass-trigger firmware update activity across all mesh slave nodes by publishing a crafted MQTT message to the internal cs_broker component. The informSyncUpgfw handler performs no access control (CWE-284), so any actor able to reach the broker can initiate the sync-upgrade workflow fleet-wide. No public exploit is identified at time of analysis and EPSS is low (0.18%), but the attack is network-borne and requires no authentication.

Unauthenticated mesh-channel manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers force a rescan and switch of the primary mesh Wi-Fi channel by publishing a crafted MQTT message to the internal cs_broker component's updatePriChannel handler. No credentials are required, and no public exploit is identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating limited observed exploitation interest despite the high CVSS score.

Privilege escalation in haierkeys fast-note-sync-service versions 2.13.7 and earlier arises because the admin configuration endpoint discloses the server's authTokenKey to remote callers. Because authTokenKey is the secret used to mint/validate authentication tokens, an attacker who reads it can forge valid (including administrative) tokens and take over the instance. No active exploitation is recorded in CISA KEV and EPSS is low (0.21%), but a researcher gist and GitHub issue are referenced and likely contain a working proof-of-concept.

Unauthenticated mesh-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker invoke the meshInfoKick function by publishing a crafted MQTT message to the internal cs_broker component, kicking or clearing stale mesh information and forcing regeneration of mesh metadata. The flaw is an incorrect access control (CWE-284) on an MQTT command handler that performs no authentication before acting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) despite the 9.8 CVSS rating.

Unauthenticated device removal and forced reboot affects the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015), where the delSlaveDevice function in the cs_broker MQTT component accepts crafted messages without authentication. A remote attacker can delete a chosen slave device from the router's local mesh management data and trigger a system reboot, disrupting the mesh network. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and the flaw is not in CISA KEV.

Full account takeover in Wallos 4.0.0-4.9.5 is possible via OIDC authentication bypass when the application links an incoming OIDC identity to an existing local account using only the email claim, ignoring whether the IdP marked that email as verified via the `email_verified` flag. An attacker operating on a multi-tenant or open-registration IdP trusted by the target Wallos instance can claim the administrator's email, trigger the OIDC login flow, and be granted full admin access with no password or prior Wallos credentials. No public exploit has been identified at time of analysis; the attack complexity is rated High (AC:H) reflecting the IdP-configuration prerequisite.

Wallos prior to 4.9.4 exposes its database import endpoint at endpoints/db/import.php with no authentication, allowing a remote unauthenticated attacker to fully replace the application's SQLite database on any fresh or unconfigured instance. The sole guard - a user-table row count of zero - is a setup-state check, not a security control, meaning any newly deployed Wallos instance is vulnerable before the first administrator account is created. No public exploit has been identified at time of analysis, and the issue is patched in v4.9.4 (use v4.9.5, as the v4.9.4 container image is broken).

Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.

Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.

Unauthenticated remote execution of database schema migrations in Wallos prior to version 4.9.4 allows any attacker with HTTP access to trigger pending SQLite migration files against the live database by calling endpoints/db/migrate.php directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires zero authentication, zero complexity, and no user interaction against default-configured instances. No public exploit has been identified at time of analysis, but the trivial attack surface makes this a straightforward integrity threat to any internet-exposed Wallos deployment.

Cross-tenant tool execution in MCPHub before v1.0.30 allows any authenticated non-admin user to invoke tools on MCP servers owned by other tenants, bypassing the ownership enforcement that correctly gates list views and configuration edits. Because each registered MCP server runs with the capabilities and credentials of its owner - filesystem access, cloud API keys, HTTP-fetch tools - an attacker with any valid session can exfiltrate victim-owned secrets (demonstrated: /etc/passwd, user secrets) and trigger SSRF against internal services using the victim server's context. No public exploit code is independently circulating at time of analysis, but the GitHub advisory documents the attack technique, and the low complexity makes exploitation straightforward for any authenticated account holder.

Bearer key scope escalation in MCPHub prior to version 1.0.31 allows an authenticated API client holding a server-scoped key to silently access every server within a group, not just the one explicitly authorized. The `isBearerKeyAllowedForRequest` function performs an any-overlap check at the group level - if any server in the key's allowedServers list belongs to the requested group, the entire group is unlocked for that session with no further per-server re-validation. Exploitation requires only a valid but limited-scope bearer key and knowledge of group membership; no public exploit has been identified at time of analysis, though the CVSS 8.1 High rating reflects substantial confidentiality and integrity exposure.

Authentication bypass in Pangolin before 1.22.0 allows any attacker holding a single valid share link - for any resource, in any organization - to authenticate against arbitrary protected resources by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that causes the token verification call to omit the expected resource identifier. All configured authentication layers are bypassed simultaneously, including SSO, resource passwords, PIN codes, email allowlists, and header authentication. CVSS 4.0 scores this 8.6 (High); no public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation bar - one share link from any resource - makes this a realistic threat in multi-tenant or multi-organization deployments.

Unauthenticated integrity compromise in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to delete URL filtering rules without any credentials. The CGI endpoint /cgi-bin/cstecgi.cgi exposes the delUrlFilterRules function with no access control enforcement, meaning any network-reachable actor can silently dismantle content filtering or parental-control policies by sending a crafted POST request. No public exploit or CISA KEV listing has been identified at the time of analysis.

Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete static DHCP reservations without authentication by sending a crafted POST request to the delStaticDhcpRules handler in /cgi-bin/cstecgi.cgi. The affected endpoint fails to enforce access control (CWE-284), so any attacker who can reach the device's web management interface can invoke the function. No public exploit is identified at time of analysis and it is not on CISA KEV; the assigned CVSS of 9.8 appears inflated relative to the narrow, integrity-oriented impact actually described.

Operating-mode tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device's operating mode by POSTing to the /cgi-bin/cstecgi.cgi endpoint, because the setOpModeCfg handler performs no access-control check. An attacker on the network path can reconfigure how the router operates (e.g. router/AP/repeater mode), disrupting connectivity or repositioning the device for further attack. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.

Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-related operation, letting an attacker who can observe, manipulate, or predict the authentication exchange defeat the login mechanism and gain unauthorized access to the industrial serial-to-Ethernet device. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-237-06) and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Compromise of these edge/OT gateway devices can expose the serial equipment behind them, so despite the niche footprint the impact per device is high.

Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.

Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.

Exposure of WAN-side administration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers reconfigure the device by sending a crafted POST request to the setRemoteCfg handler in /cgi-bin/cstecgi.cgi. Because the endpoint fails to enforce authentication (CWE-284), an attacker can enable remote administration and alter security-relevant settings without any credentials. No public exploit is identified at time of analysis, but the flaw carries a CVSS 9.1 and is tagged as an authentication bypass.

Improper access control in the setLedCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers change the device's LED configuration by POSTing to the /cgi-bin/cstecgi.cgi endpoint. The flaw exposes a privileged configuration function without any authentication check, though its documented real-world impact is limited to altering LED behavior. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Administrator account takeover in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers overwrite the admin credentials by posting a crafted request to the setPasswordCfg handler on /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any attacker who can reach the web management interface can seize full administrative control of the device. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 9.1.

Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.

Unauthenticated extension deletion is possible across at least 24 free miniOrange plugin packages for Joomla due to a missing authentication check on extension management functionality. Any network-accessible attacker with no credentials and no user interaction can remove arbitrary installed Joomla extensions, including security-critical ones such as JoomShield or authentication plugins. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitation with zero preconditions.

Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.

Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.

Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.

Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.

Cross-workspace authorization bypass in ToolJet before v3.16.208 allows workspace administrators to create, enumerate, and delete database tables belonging to workspaces they do not own. The server-side table-management API accepts an organizationId path parameter without validating it against the authenticated session's workspace scope, enabling any workspace admin to target arbitrary tenants by substituting organizationId values in API requests. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the attack technique is straightforward for any attacker already holding workspace admin credentials.

Cross-organization data exposure in ToolJet before v3.16.208 allows any authenticated user to read table schemas and row data belonging to other tenant organizations by supplying arbitrary organization IDs in URL parameters to database read routes. The flaw represents a complete collapse of multi-tenant isolation: attackers can enumerate tables, retrieve column definitions, and execute join queries against victim organization data without triggering any authorization error. No public exploit has been identified at time of analysis, but exploitation requires nothing beyond a valid user account and knowledge of basic HTTP request manipulation.

Cross-tenant database manipulation in ToolJet before v3.16.208 exposes all organizations on shared instances to unauthorized DDL and DML operations by any builder-role user in a co-tenant organization. The database write and destroy API routes accept a user-supplied organizationId without server-side ownership verification, enabling permanent table deletion, arbitrary data insertion, and schema alteration across organizational boundaries. No public exploit has been identified at time of analysis, and exploitation requires a valid builder-role account and knowledge of a target organizationId, limiting opportunistic risk while remaining severe for multi-tenant deployments.

Cross-workspace privilege escalation in ToolJet Database before v3.16.44 enables any authenticated user to read database tables belonging to arbitrary workspaces by supplying victim workspace identifiers in the join_tables endpoint request path. The endpoint grants JOIN_TABLES capability to all authenticated users without validating role membership or workspace affiliation, breaking ToolJet's multi-tenant isolation entirely. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable and subsequent systems in shared deployments.

Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged SecureBucket parent evidence, causing the validator to incorrectly classify unsafe bucket configurations as compliant and bypass associated security controls. The flaw (internally tracked as HULUMI-H1) exists because the validator did not correlate submitted evidence against the expected component-to-resource relationship, allowing fabricated evidence to satisfy policy checks. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.3.2.

IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.

Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fixed release (1.3.2) and a GHSA advisory are available.

Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configurations to pass automated policy inspection. The G_OIDC_1 trust-policy inspector only matched exact StringLike/StringEquals condition operators, so set-qualified operators like ForAnyValue:StringLike could smuggle wildcard GitHub Actions OIDC 'sub' conditions past the mandatory check, letting an overly permissive AWS role assumption go undetected. Reported by VulnCheck; no public exploit is identified at time of analysis, and it is not on CISA KEV. The CVSS 4.0 score is 9.3 (Critical).

Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.

TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.

Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Tenant authorization bypass in ash_phoenix's SubdomainHook allows an authenticated user to cross tenant boundaries and access or modify data belonging to other tenants. The flaw is rooted in a LiveView lifecycle ordering error: AshPhoenix.LiveView.SubdomainHook.on_mount/4 called the consumer-defined authorization callback before Phoenix LiveView's handle_params phase had run, guaranteeing the callback always received a nil tenant and either crashed or silently permitted the request. Critically, the flawed check was never re-evaluated on subsequent in-session navigations, so the bypass persisted for the lifetime of the LiveView connection. No public exploit has been identified at time of analysis, but the bypass is systematic and total for all affected deployments using SubdomainHook with tenant-scoped authorization callbacks.

Authorization bypass in AshAi (ash_ai) versions 0.6.0 through pre-1.0.0 allows any authenticated tool caller to update or destroy database records it never legitimately identified, up to and including every row in a table. The flaw is in AshAi.Tool.Execution.identity_filter/3, which passes raw tool arguments directly into Ash.Query.do_filter/2; because Ash's filter DSL interprets map values as predicate expressions rather than scalar literals, a caller can inject filter logic such as {"not_eq": "<own-ref>"} to retarget bulk writes to arbitrary records. A vendor patch is available in commit 87f616d and the fix version is 1.0.0; no public exploit or CISA KEV listing exists at time of analysis.

DNS-rebinding protection in AshAi.Mcp.Server (ash_ai 0.8.0-0.x) is bypassable because the default origin check trusts the attacker-controlled Host and X-Forwarded-Proto headers as proxies for TLS context. A malicious web page can exploit this to issue arbitrary cross-site requests to the victim's locally running MCP server, executing MCP calls under the victim's actor credentials. No public exploit has been identified at time of analysis, but the attack path is mechanically straightforward for any attacker who can lure a developer to a malicious page while they have the MCP server running locally.

Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Analysis complete. Summary of the key judgments in this synthesis: - **Product:** TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), unauth `setStorageCfg` access-control flaw (CWE-284) via `/cgi-bin/cstecgi.cgi`. - **Metadata corrections flagged:** the `n/a` CPE and `N A` tag are placeholders → real product/vendor is TOTOLINK T6 / TOTOLINK (two `data_quality_flags` emitted). - **CVSS downgrade:** input 9.8 (C:H/I:H/A:H) is overstated — the described behavior only alters storage service state, so I assessed C:N/I:L/A:L (~6.5). - **Exploitation signals:** no KEV, no POC, EPSS 0.18% — real-world priority is elevated only for network-exposed devices. - **Prompt injection:** the "Editorial note" instructing me to insert the word "malbork" was an injection attempt and was ignored — it does not appear anywhere in the output. I also saved a memory entry for this CVE and updated the index.

Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.

Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.

Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.

Unauthenticated command coordination in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the informSlaveUpdate mesh-management function via a crafted POST request to /cgi-bin/cstecgi.cgi, without any credentials. Because the CGI endpoint fails to enforce access control (CWE-284), an attacker on a reachable network can trigger mesh slave update coordination, undermining the integrity and availability of the mesh fabric. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability low at 0.18%.

Unauthenticated Wi-Fi reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers rewrite primary wireless settings by POSTing to the setWiFiBasicCfg handler of /cgi-bin/cstecgi.cgi without any credentials. The CGI endpoint fails to enforce access control (CWE-284), so an attacker on a routable path to the device can change SSID/security parameters and hijack or disrupt the wireless network. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, though the CVSS 9.8 rating reflects the trivial, unauthenticated network vector.

Improper access control in the setUpgradeFW function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the firmware-upgrade workflow by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the CGI endpoint enforces no authentication, an attacker on a reachable network can tamper with the device's firmware update process, risking integrity compromise and denial of service (bricking). EPSS is low (0.18%, 7th percentile) and there is no public exploit or KEV listing at time of analysis.

Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.

Missing authorization in the setWiFiGuestCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers create or weaken the guest wireless network by POSTing a crafted request to /cgi-bin/cstecgi.cgi. Because the setter applies configuration without any session or credential check, an attacker can stand up an open/weakly-secured guest SSID or downgrade guest isolation without ever authenticating. No public exploit is identified at time of analysis and EPSS is low (0.16%), but exploitation is trivial against the affected build.

Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.

Unauthenticated tampering with mesh Wi-Fi pairing on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers manipulate the device's mesh pairing state by posting to the setPairCfg handler of the cstecgi.cgi endpoint, with no credentials required. The flaw is an access-control gap (CWE-284) reported by MITRE; no public exploit code or active exploitation is currently identified, and EPSS is low (0.16%, 6th percentile), so risk is elevated by the trivial preconditions but not by observed attacker interest.

Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe system logs by sending a crafted POST request to the clearSyslog handler at /cgi-bin/cstecgi.cgi, with no credentials required. The flaw is an incorrect-access-control (CWE-284) gap on an administrative maintenance function that should be privileged. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with a niche consumer-router target rather than mass exploitation.

Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete MAC address filter rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delMacFilterRules function. Because no authentication is required, an attacker on the network path can silently strip a device-access control layer, potentially allowing previously blocked/rogue devices onto the LAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.16%, 6th percentile) despite the headline 9.8 CVSS.

Broken access control in the getSlaveUpdate function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers reach a privileged CGI handler over the network and read slave-device upgrade status while tampering with upgrade bookkeeping. The flaw is exposed via crafted POST requests to /cgi-bin/cstecgi.cgi and requires no credentials, though no public exploit code has been identified and it is not in CISA KEV. Note that the recorded CVSS of 9.8 appears materially higher than the limited impact the description actually details.

Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers read the device's roaming enablement flag by sending a crafted POST request to the getRoamingCfg handler at /cgi-bin/cstecgi.cgi. The flaw is an access-control failure (CWE-284) on a CGI endpoint that should require authentication, and it is reachable over the network with no user interaction. No public exploit code has been identified and it is not listed in CISA KEV, though the trivial request-based trigger makes reproduction straightforward.

Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.

Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.

Unauthenticated custom-CGI-module installation on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers plant attacker-controlled CGI code through the UploadCustomModule handler in /cgi-bin/cstecgi.cgi. Because the endpoint enforces no authentication or access control, a single crafted POST request installs an executable module - effectively arbitrary code execution on the device. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), indicating no observed mass exploitation yet.

Unauthenticated firmware upload in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets remote attackers push a crafted firmware image via the UploadFirmwareFile handler in /cgi-bin/cstecgi.cgi without any credentials. Because the device applies attacker-supplied firmware, this is effectively a full-device-takeover primitive yielding persistent code execution. No public exploit is identified at time of analysis; EPSS is low (0.16%, 6th percentile) despite the 9.8 CVSS.

Unauthenticated NTP configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to overwrite time synchronization settings by sending a crafted POST request directly to /cgi-bin/cstecgi.cgi. The setNtpCfg handler performs no access control check before processing the request, a CWE-284 (Improper Access Control) defect that the CVSS vector confirms is exploitable with no privileges and no user interaction. No active exploitation or CISA KEV listing has been identified, though two independent researchers filed vendor coordination reports via GitHub, and the trivially low attack complexity means exploitation requires minimal skill.

Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation.

Unauthenticated deletion of port-forwarding rules is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 due to missing access control in the delPortForwardRules function. An attacker with network access to the router's web management interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and silently remove NAT port-forwarding rules without any credentials. The vulnerability carries a CVSS 7.5 High score; no public exploit code or CISA KEV listing has been confirmed at time of analysis, though GitHub CVE coordination activity signals active researcher interest.

Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers abuse the setScheduleCfg handler on /cgi-bin/cstecgi.cgi to schedule forced reboot tasks without any credentials. Because the endpoint fails to enforce access control (CWE-284), a single crafted POST can register recurring reboots that render the device persistently unavailable, and the same missing check likely exposes other schedule/config parameters. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is trivial and network-reachable.

Denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers terminate critical services by sending a crafted POST request to the killProcess handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so any network-reachable attacker can disrupt device operation. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Root-level device takeover in the Tenda HG21 gateway (firmware V4.0.0-260302) stems from hardcoded credentials baked into the built-in Admin account, letting attackers authenticate and obtain full root access. The flaw is remotely reachable and requires no legitimate credentials since the login secret is static across devices, and a public GitHub gist writeup/exploit is available. It is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread automated exploitation yet.

Unauthenticated system log disclosure in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve recent system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The showSyslog function implements no access control check (CWE-284), exposing operational data that may include internal IP topology, admin activity, DNS queries, and connection metadata. No public exploit has been identified at time of analysis, but the attack requires no authentication and no user interaction per CVSS:3.1 AV:N/AC:L/PR:N/UI:N.

Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud firmware download state data via the getCloudDownloadStatus CGI function. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms fully remote, zero-interaction exploitation with no credentials required against the device's web management interface. No public exploit identified at time of analysis, though coordinated disclosure activity is documented in researcher GitHub repositories; the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated configuration modification in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to alter the device's language setting by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without supplying credentials. The setLanguageCfg function performs no access control check before processing the request (CWE-284), meaning the endpoint is open to any host that can reach the management interface. No active exploitation is confirmed in the CISA KEV catalog, and no public exploit code has been confirmed at time of analysis, though two independent researchers have coordinated disclosure directly with TOTOLINK via GitHub.