TP-Link

An authenticated OS command injection vulnerability in the TP-Link Archer AX17 router allows administrative LAN users to achieve root command execution via malicious OpenVPN client profile descriptions.

An authenticated stack-based buffer overflow in the TP-Link Tapo C320WS camera allows remote code execution as root via the Wi-Fi onboarding process.

A hard-coded RSA-512 private key in TP-Link Deco mesh firmware allows adjacent attackers to impersonate trusted nodes, enabling unauthorized configuration changes and firmware modification.

An authenticated remote code execution vulnerability (CVE-2026-16348) in the TP-Link Archer BE800 management interface allows attackers with administrator privileges to execute arbitrary commands via shell injection in the VPN key field.

An authenticated OS command injection vulnerability, CVE-2026-75616, in TP-Link Archer C20 v6 routers allows an administrator to achieve root-level code execution via the BPA WAN configuration interface.

A commodity BadIIS malware variant is fueling a thriving malware-as-a-service (MaaS) ecosystem for Chinese-speaking cybercrime groups, allowing them to execute malicious SEO fraud, hijack server content, and redirect traffic to illicit sites.

Threat actors are leveraging AI to enhance vulnerability discovery, exploit development, defense evasion, and autonomous operations, with state-sponsored groups showing particular interest in AI-driven vulnerability research and exploit generation.

A new Mirai-based malware campaign is exploiting CVE-2025-29635, a command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.