Network-Infrastructure

A critical vulnerability in D-Link DHP-W610AV allows remote attackers to force an empty password configuration via the HNAP Login interface, enabling unauthorized access.

DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218 is vulnerable to unauthenticated remote command injection via the set_table function in mainfunction.cgi.

A vulnerability in the Netis EAP930 CGI endpoint allows remote attackers to trigger a backdoor via crafted manipulation of the SIGNATURE argument in the /cgi-bin/debug file.

CVE-2020-16152 is a high-severity local file inclusion vulnerability in Extreme Networks HiveOS and IQ Engine that permits root-level remote code execution via log poisoning.

Netcore NR256CN routers up to version 1.5.140116 are vulnerable to a pre-authentication stack buffer overflow in the Boa web server's user_ok() function, allowing remote code execution or denial-of-service.

An unauthenticated heap-based buffer overflow in the Secure Vector Routing (SVR) component of Juniper Junos OS allows remote attackers to trigger denial-of-service or potentially execute arbitrary code via malformed IPv4 packets.

The wmapd daemon in Wavlink WL-WN592AX6 firmware version 250422 is vulnerable to remote, unauthenticated OS command injection, allowing full device takeover.

An unauthenticated remote command injection vulnerability in the web management backend of legacy TRENDnet routers allows arbitrary OS command execution via manipulated arguments to pigwidgeon.cgi.

A critical stack-based buffer overflow vulnerability (CVE-2026-101081) in the D-Link DI-8400 web administration interface allows remote attackers to trigger memory corruption and achieve remote code execution.

A critical stack-based buffer overflow vulnerability in the devdiscover service of FAST FAC1200R routers allows unauthenticated remote attackers to achieve code execution via malformed advertisement frames.

Cisco has confirmed active, in-the-wild exploitation of a zero-day vulnerability, CVE-2026-76460, affecting its Identity Services Engine (ISE) product.

Authenticated attackers can execute arbitrary shell commands as root on multiple Lantronix console manager models by exploiting an undocumented MFC EEPROM read command that triggers command injection via a system call.

Netcore NBR200V2 version 1.3.241127.071246 is vulnerable to remote command injection via the Traceroute Diagnostic Feature, allowing unauthenticated attackers to execute arbitrary commands.

A stack-based buffer overflow vulnerability in the Comfast CF-N1-S Web Management Interface (CVE-2026-94003) allows remote, unauthenticated attackers to execute arbitrary code via a malicious URI request.

A vulnerability in BIND 9 resolvers configured with DNS64 allows an authoritative server to cause a process crash through malformed responses, resulting in a denial of service.

Multiple vulnerabilities in Aruba EdgeConnect allow for privilege escalation, denial of service, information disclosure, file manipulation, cross-site scripting, security bypass, and arbitrary code execution.

A critical stack-based buffer overflow vulnerability in the D-Link DI-8300 CGI service enables remote code execution via a manipulated URL parameter.

An unauthenticated denial of service vulnerability in Net-SNMP versions up to 5.9.5.2 allows remote attackers to hang the snmpd process by initiating idle connections to the SMUX module.

VMware Aria Operations for Networks versions 6.0 to 6.10 contain a vulnerability involving static SSH keys that allow unauthorized remote access and root-level privilege escalation.

The TOTOLINK NR1800X router is vulnerable to remote command injection via the setUssd function in cgi-bin/cstecgi.cgi, enabling unauthenticated attackers to execute arbitrary system commands.

An unauthenticated remote file read vulnerability in MikroTik RouterOS (CVE-2018-14847) allows attackers to extract and decrypt administrative credentials, leading to full system compromise.

Authenticated attackers can exploit a command injection flaw in the DrayTek VigorSwitch commandTable function to achieve root-level remote code execution.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability (CVE-2026-71921) in the setget.cgi interface that allows unauthenticated remote attackers to execute arbitrary commands as root.

Citrix has released patches for critical vulnerabilities including CVE-2026-19490, an authentication bypass, and CVE-2026-19489, a memory overflow vulnerability affecting NetScaler ADC and Gateway appliances.

A critical command injection vulnerability (CVE-2026-75094) in the COMFAST CF-N1-S CGI interface allows remote, authenticated attackers to execute arbitrary OS commands via the 'ssid' parameter.

Multiple GL.iNet router models running firmware versions up to 4.8.x contain an authorization bypass vulnerability in the WebDAV service, allowing remote unauthenticated attackers to manipulate file operations.

A stack-based buffer overflow vulnerability in Tenda W20E firmware allows authenticated remote attackers to achieve potential code execution via the QoS Edit component.

CVE-2026-68123 is a vulnerability in Open vSwitch related to GSO userspace truncation that may cause an underflow condition during packet processing, potentially impacting memory or system stability.

An authenticated administrator can exploit a command injection vulnerability in the export-cgi program of Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 to execute arbitrary OS commands.

Multiple Wavlink networking devices are vulnerable to a remote stack-based buffer overflow in the lighttpd component due to insecure use of strcpy in the upload.cgi script via the HTTP_COOKIE header.

Multiple vulnerabilities in Internet Systems Consortium BIND allow an anonymous, remote attacker to bypass security measures, manipulate data, disclose confidential information, or trigger a Denial-of-Service condition, potentially leading to compromise of data integrity, confidentiality, and availability of the DNS service.