IoT

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices to deploy botnet payloads and establish persistent backdoors.

An unauthenticated credential disclosure vulnerability in various DVR devices allows attackers to retrieve administrative credentials via the /device.rsp endpoint.

An authentication bypass vulnerability in the ASUSWRT infosvr daemon allows unauthenticated remote attackers to execute arbitrary system commands with root privileges via UDP port 9999.

Puwell IP cameras (firmware 2.x - 4.x) contain an unauthenticated remote code execution vulnerability in a DebugShell interface on TCP port 34567, which is currently being targeted by botnets.

Tenda NVR_4H firmware version V27.5.58.6 contains a hardcoded ECDSA private key and self-signed certificate in the read-only partition, enabling full TLS session interception via man-in-the-middle attacks.

An exposed dangerous function in the Alpine iLX-F511 Framework Service allows unauthenticated, network-adjacent attackers to achieve remote code execution as root.

CVE-2025-52694 is a critical unauthenticated SQL injection vulnerability in Advantech IoTSuite and IoT Edge products that allows remote database manipulation and potential code execution.

An unauthenticated denial-of-service vulnerability in Intelbras IP cameras allows local network attackers to trigger infinite reboots via the firmware upgrade endpoint.

Attackers are hijacking Dahua IP cameras and recorders via the Easy4IP P2P cloud access feature by using brute-force attacks or exploiting CVE-2021-33044 and CVE-2021-33045 to gain unauthorized device control.

An unauthenticated command injection vulnerability in the Avocent ACS8000 wsserver daemon allows attackers to execute arbitrary commands with root privileges by sending malicious input via WebSocket fields.

A NULL-pointer dereference vulnerability in the OpenThread DNS-SD Discovery Proxy allows a remote attacker on the same Thread mesh to trigger a denial of service on the Border Router via two crafted DNS-SD queries.

A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.

Public proof-of-concept exploits are available for two vulnerabilities in the ThroughTek TUTK SDK (v3.1.10.0-4.3.8.1) that could allow remote heap overflow and out-of-bounds read conditions in downstream IoT devices.

An OS command injection vulnerability in the TOTOLINK X2000R router allows an authenticated attacker to execute arbitrary system commands via the boa formPasswordSetup function.

A vulnerability in the Zephyr RTOS OSDP Control Panel implementation allows attackers with access to the RS-485 bus to trigger a stack-based buffer overflow and potential code execution.

Jooan JA-A12 IP cameras running specific firmware versions are vulnerable to unauthenticated remote code execution via a hard-coded credential flaw that allows command injection into the jooandiag daemon.

Swann Communications SWIFI-SE2KIC security cameras contain multiple authentication bypass vulnerabilities (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) that allow unauthenticated local network attackers to access live video streams and snapshots.

The wmapd daemon in Wavlink WL-WN592AX6 firmware version 250422 is vulnerable to remote, unauthenticated OS command injection, allowing full device takeover.

A vulnerability in the D-Link DCS-930L Emergency HTTP Recovery Server allows remote attackers to bypass cryptographic firmware verification through manipulation of the firmware update argument.

IBM Maximo Application Suite IoT Component versions 9.0.0, 9.1.0, and 9.2.0 are susceptible to a remote denial of service vulnerability triggered by an infinite parsing loop.

A critical buffer overflow vulnerability in the Edimax BR-6208AC router allows unauthenticated remote code execution via manipulation of the ifname argument in the /goform/formWlSiteSurvey handler.

Johnson Controls EasyIO FG firmware versions <=2.0b52 are affected by hard-coded credentials and improper privilege management vulnerabilities (CVE-2026-27872, CVE-2026-27873), potentially allowing full device compromise.

Multiple missing authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI Service allow authenticated users to access sensitive device data and manipulate configurations for unauthorized devices.

The Viidure Dashcam Android application (<= 3.3.1.260403) contains two high-risk vulnerabilities, including hard-coded cloud credentials and misconfigured public cloud storage, that expose sensitive user data and platform firmware.

Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4_build_2024-12-26 contains multiple critical vulnerabilities, including command injection, hard-coded credentials, and lack of firmware signing, allowing remote unauthenticated attackers to gain full system control.

An unauthenticated remote command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 allows attackers to execute arbitrary commands via the USB Device Management API.

A remote command injection vulnerability in the D-Link DWR-M920 router allows unauthenticated attackers to execute arbitrary system commands via the /boafrm/formPinManageSetup interface.

Advantech WISE-6610 series gateways are vulnerable to unauthenticated remote command injection via the Basic Station Certificate-Deletion Handler, potentially leading to full system compromise.

An unauthenticated remote command injection vulnerability in Tenda CP3 firmware version 27.5.57.101 allows attackers to execute arbitrary system commands via the AlarmVoiceURL argument.

Unitree G1 EDU firmware versions 1.5.2 and earlier contain a chained vulnerability in the BLE GATT server and WiFi provisioning stack, allowing unauthenticated proximate attackers to achieve root-level remote code execution.

A critical stack-based buffer overflow vulnerability in the /sbin/mycli binary of TRENDnet TEW-755AP access points allows remote unauthenticated attackers to execute arbitrary code via the 'ssid' argument.

A critical stack-based buffer overflow vulnerability (CVE-2026-75877) in the TRENDnet TV-IP751WIC alphapd component allows remote attackers to execute arbitrary code via multiple affected functions.

TIER IV Nebula through 1.2.0 is vulnerable to an out-of-bounds read in the Vlp32Decoder::unpack function, allowing remote attackers to inject fabricated point cloud data via malformed UDP packets.

The Pulsetto Vagus Nerve Stimulator firmware contains undocumented Bluetooth Low Energy commands that allow an adjacent attacker to bypass safety mechanisms and modify stimulation settings without authentication.

Kimwolf v7 is an evolved Android/IoT botnet that leverages unauthenticated ADB access, Ethereum Name Service (ENS) resolution, and HTTP/2 browser fingerprinting to perform resilient DDoS operations.

Tenda CH22 firmware version 1.0.0.1 is vulnerable to unauthenticated remote command injection via the formCertListInfo function, allowing for arbitrary system command execution.

A critical stack-based buffer overflow in the Tenda W6-S web management interface allows unauthenticated remote attackers to cause a denial of service or potentially execute arbitrary code.

Johnson Controls TL280 devices running firmware versions below 5.63 contain hardcoded credentials and utilize insecure cryptographic algorithms, potentially allowing unauthorized access.

A critical command injection vulnerability in the nas-web RPC Wrapper of GL.iNet GL-MT3000 routers allows unauthenticated remote attackers to execute arbitrary system commands via the /cgi-bin/glc interface.

Multiple unauthenticated remote command injection vulnerabilities in the GL.iNet GL-MT3000 router allow arbitrary code execution via the /cgi-bin/glc component. Public exploit code is available; patch firmware immediately.

A public Proof of Concept (PoC) is available for CVE-2026-10672, an out-of-bounds read vulnerability in the LwM2M firmware update component of Zephyr RTOS versions 3.0.0 through 4.4.0, allowing an attacker to exfiltrate up to 13 bytes of sensitive data from adjacent memory via crafted CoAP requests, significantly elevating risk for unpatched IoT and embedded systems.

An unauthenticated remote attacker can achieve critical remote code execution in X-Rite MA-T6 devices running versions prior to v2.33 due to improper input sanitization in the `SetParameter` command, allowing for OS command injection via CVE-2023-49900.

An incomplete fix for CVE-2026-40882 in OpenRemote's KNXProtocol module (specifically in versions <= 1.24.1 of the agent module) allows authenticated users to perform an XML External Entity (XXE) injection, enabling arbitrary file read from the server's filesystem, including sensitive configuration files and potentially leading to server-side request forgery (SSRF) against cloud metadata endpoints or internal services, without requiring administrator access.

A stack-based buffer overflow vulnerability (CVE-2026-14606) exists in RT-Thread versions up to 5.0.2, specifically in the `CAN_Receive` function of the SWM341 CAN Handler component, allowing for local exploitation via manipulation, with a public exploit available.

An unauthenticated OS command injection vulnerability, CVE-2026-58457, exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02), allowing network-adjacent attackers to execute arbitrary shell commands and gain full root-level control by injecting unsanitized input into the `smacfilter_conf` handler's GET parameters within the `commuos` web backend.

A public exploit is available for a Server-Side Request Forgery (SSRF) vulnerability in ThingsBoard IoT Platform 4.2.0, increasing the risk for unpatched systems.

Multiple vulnerabilities in Cisco IoT Field Network Director Software could allow an authenticated, remote attacker to access files, execute commands, and cause denial-of-service (DoS) conditions on managed routers.

Commercially available Unitree robots are susceptible to multiple vulnerabilities, including hardcoded keys and command injection, allowing attackers to gain root-level access, exfiltrate data, and potentially create physical botnets.

EFM ipTIME C200 devices are vulnerable to remote command injection due to insufficient validation of the RestoreFile argument in the /cgi/iux_set.cgi endpoint, allowing attackers to execute arbitrary commands with elevated privileges.

A remote buffer overflow vulnerability exists in UTT HiPER 1200GW up to version 2.5.3-1703 due to manipulation of the strcpy function in the /goform/formUser file, potentially leading to arbitrary code execution.

A buffer overflow vulnerability exists in UTT HiPER 1200GW devices up to version 2.5.3-170306, stemming from manipulation of the `strcpy` function in the `/goform/formRemoteControl` file, which allows remote attackers to execute arbitrary code.

A buffer overflow vulnerability in UTT HiPER 1250GW devices (versions up to 3.2.7-210907-180535) allows remote attackers to execute arbitrary code by manipulating the 'Profile' argument in the `strcpy` function of the `route/goform/ConfigAdvideo` file, due to insufficient bounds checking.

A remote buffer overflow vulnerability exists in Totolink N300RT 3.4.0-B20250430 via manipulation of the 'entry_name' argument in the /boafrm/formIpQoS file, potentially leading to arbitrary code execution.

A command injection vulnerability exists in D-Link DIR-822 A_101, specifically within the udhcpd DHCP service; by manipulating the Hostname argument, a remote attacker can inject commands, but the affected product is no longer supported.

A buffer overflow vulnerability in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon allows remote attackers to execute arbitrary code by manipulating the nextHop argument in the formRoute function of the /boaform/formRouting file, impacting device availability and integrity.

A new Mirai-based malware campaign is exploiting CVE-2025-29635, a command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.

Anviz CX2 Lite and CX7 devices are vulnerable to unauthenticated POST requests that allow modification of debug settings such as enabling SSH, leading to unauthorized state changes and potential compromise.

Anviz CX2 Lite is vulnerable to an authenticated command injection via the filename parameter, leading to arbitrary command execution and root-level access.

Anviz CX2 Lite and CX7 devices are vulnerable to unverified update packages that allow for unauthenticated remote code execution by unpacking and executing a malicious script.

A remote buffer overflow vulnerability exists in the Totolink A800R router version 4.1.2cu.5137_B20200730, allowing unauthenticated attackers to potentially execute arbitrary code by overflowing the apcliSsid argument in the setAppEasyWizardConfig function within the /lib/cste_modules/app.so library.

A remote stack-based buffer overflow vulnerability exists in the fromDhcpListClient function of the /goform/DhcpListClient component (httpd) within Tenda F451 firmware version 1.0.0.7, triggered by manipulating the 'page' argument, potentially allowing for arbitrary code execution.

A stack-based buffer overflow vulnerability exists in Tenda F451 version 1.0.0.7 within the fromAddressNat function of the /goform/addressNat component, allowing for remote exploitation by manipulating the 'entrys' argument.

Law enforcement has disrupted significant IoT botnets responsible for launching record-breaking distributed denial-of-service (DDoS) attacks, impacting the availability of targeted systems.

CVE-2024-45163 is a remote denial-of-service vulnerability affecting Mirai command and control (C2) infrastructure, potentially disrupting botnet operations and related malicious activities.

The OpenRemote IoT platform is vulnerable to expression injection, allowing remote code execution due to an unsandboxed Nashorn JavaScript engine and an inactive Groovy sandbox, leading to full server compromise.