#IoT
All CosmicBytez Labs articles tagged #IoT, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-109110: Wavlink WL-WN592AX6 Unauthenticated OS Command Injection
A critical, unauthenticated command injection in Wavlink WL-WN592AX6 routers lets remote attackers run arbitrary OS commands as root.
- Security
CVE-2026-108895: Linksys E1700 setDMZ OS Command Injection
A public exploit targets Linksys E1700 routers via the setDMZ goform handler, letting remote attackers inject OS commands through the MAC_addr parameter.
- Security
CVE-2026-108896: Linksys E1700 setLinksysIpv6 OS Command Injection
The Linksys E1700's IPv6 configuration handler injects the 6rd_prefix parameter into a shell command, letting remote attackers run arbitrary code.
- Security
CVE-2026-108576: Unauthenticated OS Command Injection in TOZED X300 Router (CVSS 10.0)
A maximum-severity flaw in TOZED X300 firmware ≤ 6.01.3 lets unauthenticated attackers inject OS commands via the IPPingDiagnostics Host field.
- Security
CVE-2026-105110: Iskratel Innbox GPON ONT Unauthenticated OS Command Injection
Unauthenticated OS command injection in Iskratel Innbox GPON ONT's login.xgi endpoint lets remote attackers execute commands as root.
- Security
CVE-2026-94952: Critical Unauthenticated Stack Overflow in TOTOLINK N150RT Routers
CVSS 9.8 unauthenticated stack overflow in TOTOLINK N150RT's formPortFw handler risks remote crash or code execution; no patch exists for this EOL router.
- Security
CVE-2026-96587: Viidure Dashcam Android App Hardcodes Cloud Storage Credentials
Maximum-severity CVSS 10.0 flaw: Viidure's dashcam Android app hardcodes plaintext cloud storage keys, exposing firmware and binaries to tampering.
- News
One Packet, No Password: High-Severity TDengine Zero-Day Threatens Industrial Servers
A high-severity zero-day, CVE-2026-42542, crashes TDengine time-series database servers with one packet — 730,000+ instances run in OT, IoT, and energy.
- Security
Critical Stack Overflow in FAST FAC1200R Routers Has Public Exploit
CVE-2026-101037 lets remote attackers crash or hijack FAST FAC1200R routers via the devdiscover service; a public exploit exists and no patch is available.
- Security
CVE-2026-101074: Netcore NR289-GE Pre-Authentication Stack Buffer Overflow
A critical pre-auth stack buffer overflow in Netcore NR289-GE routers lets remote attackers crash the device or potentially achieve RCE.
- Security
CVE-2026-101075: Netcore NR289-GE Unauthenticated OS Command Injection
A critical OS command injection in Netcore NR289-GE routers lets unauthenticated attackers execute root commands via location_time.cgi.
- Security
CVE-2026-101076: Netcore NR289-GE Router Unauthenticated OS Command Injection
A critical, unauthenticated OS command injection in Netcore NR289-GE routers has a public exploit, letting remote attackers run commands as root.
- Security
CVE-2026-101077: Netcore NR289-GE Authentication Bypass in the boa_temp Handler
A critical, CVSS 10 missing-authentication flaw in Netcore NR289-GE routers has a public exploit and an unresponsive vendor, with no patch in sight.
- Security
D-Link DIR-895L L2TP Parser Out-of-Bounds Write (CVE-2026-100740)
A CVSS 9.9 pre-auth out-of-bounds write in D-Link DIR-895L's L2TP control-channel parser has a public PoC and no vendor patch.
- Security
CVE-2026-96891: D-Link DIR-825 rp-l2tp Out-of-Bounds Write Enables Remote Compromise
A critical, unauthenticated out-of-bounds write in D-Link DIR-825's L2TP tunnel handling has no patch — the router is end-of-life.
- Security
CVE-2026-94003: Perfect-10 Stack Buffer Overflow in Comfast CF-N1-S Routers
Comfast CF-N1-S 2.6.0.1's mbox-config CGI handler allows unauthenticated, network-based stack buffer overflow scoring a maximum CVSS 10.0.
- Security
CVE-2026-93742: Totolink A3002MU Command Injection via formWsc
Public PoC exploits an unauthenticated command injection in Totolink A3002MU's WPS handler, giving remote attackers root on the router.
- Security
Critical Stack Overflow in D-Link DIR-823G Routers (CVE-2026-90680)
An unauthenticated stack-based buffer overflow (CVSS 9.9) in D-Link DIR-823G's HNAP1 interface allows remote attackers to corrupt memory...
- Security
CVE-2026-89009: WAVLINK Router Unauthenticated Arbitrary File Write
WAVLINK WN535M1/WN535M3 routers let unauthenticated attackers overwrite any file on the device via the root sync_server daemon.
- Security
CVE-2026-89010: WAVLINK Router Unauthenticated Root Command Injection
A critical OS command injection in WAVLINK WN535M1/WN535M3 routers lets unauthenticated attackers run root commands via sync_server.
- Security
Critical Unauthenticated Buffer Overflow in Tenda HG10 Routers
CVE-2026-82542 (CVSS 10) lets remote attackers trigger a buffer overflow in Tenda HG10 routers via the formIPv6Routing handler. Public exploit exists.
- Security
D-Link DIR-825M Disk-Format Stack Overflow (CVE-2026-82592)
CVE-2026-82592 is a critical, unauthenticated stack overflow in D-Link DIR-825M's disk-formatting endpoint, with a public exploit available.
- Security
D-Link DIR-825M LTE Upgrade Stack Overflow (CVE-2026-82593)
CVE-2026-82593 is a critical, unauthenticated stack overflow in D-Link DIR-825M's LTE firmware-upgrade handler, with a public exploit available.
- Security
TOTOLINK A720R Router: Unauthenticated Memory Corruption RCE (CVE-2026-82539)
CVE-2026-82539 (CVSS 9.4) lets remote attackers corrupt memory in TOTOLINK A720R routers via the MAC filtering CGI handler. Public PoC exists.
- Security
Critical OCPP Stack Buffer Overflow in EV Charging RTOS Clients
CVE-2026-13214 is a CVSS 9.8 stack buffer overflow in OCPP 1.6 parse_getconfig_msg() allowing unauthenticated RCE on EV charging station firmware.
- Security
CVE-2026-77946: TRENDnet TEW-821DAP Critical Stack Buffer Overflow
CVSS 10.0 RCE flaw in TRENDnet TEW-821DAP firmware lets attackers exploit NTP config with no patch available.
- Security
CVE-2026-19959: Edimax EW-7478APC Critical Stack-Based Buffer Overflow
Critical stack overflow in Edimax EW-7478APC 1.04 allows RCE via pppUserName parameter. No patch available; vendor has not responded to disclosure.
- Security
CVE-2026-19348: Critical Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater
A CVSS 9.8 critical command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater allows unauthenticated remote attackers to execute...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Quectel)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Fibocom)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via Ping Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host parameter...
- Security
D-Link DWR-M961 Command Injection via Traceroute Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host and ipVer...
- Security
CVE-2026-18602: GL.iNet GL-MT3000 Remote Command Injection via VPN Hostname
A critical command injection vulnerability in GL.iNet GL-MT3000 routers (firmware up to 4.4.5) allows remote attackers to execute arbitrary OS commands by...
- Security
CVE-2026-15704: Critical Auth Bypass in Eclipse BaSyx Go Components
Eclipse BaSyx Go Components up to v1.0.0 contains a CVSS 9.8 authorization bypass caused by inconsistent trailing-slash handling between the ABAC...
- News
In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs
This week's security roundup covers an AI-prioritizing infostealer targeting developer machines, a hardcoded Bluetooth key in 2.2 million car anti-theft...
- Security
CVE-2026-51380: Tenda AC10 v3 Buffer Overflow Enables DoS and Remote Code Execution
A critical CVSS 9.8 buffer overflow vulnerability in Tenda AC10 v3 firmware V03.03.16.09 allows remote attackers to cause permanent denial of service or...
- Security
CVE-2023-4346: KNX Protocol Connection Authorization Option 1 Account Lockout Vulnerability
A vulnerability in KNX Association KNX Protocol Connection Authorization Option 1 allows an attacker to purge all devices without additional security...
- Security
CVE-2026-15511: Critical OS Command Injection in Comfast CF-WR631AX Router
A CVSS 9.8 critical OS command injection vulnerability in the Comfast CF-WR631AX V3 router allows unauthenticated network-adjacent attackers to execute...
- News
Six U-Boot Flaws Could Enable Stealthy Firmware Attacks on Embedded Devices
Researchers have discovered six vulnerabilities in the widely deployed U-Boot bootloader that could allow attackers to execute malicious code at boot...
- News
7 Unpatched Flaws Disclosed in FatFs Filesystem Used in Millions of Embedded Devices
Security firm runZero has disclosed seven vulnerabilities in FatFs, a widely used FAT/exFAT filesystem library embedded in cameras, drones, crypto...
- Security
CVE-2026-12485: GeoVision GV-I/O Box 4E UDP Stack Overflow (IP Address Field)
A critical CVSS 10.0 stack-based buffer overflow in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated remote attackers to achieve...
- Security
CVE-2026-12486: GeoVision GV-I/O Box 4E OS Command Injection via libNetSetObj.so
Multiple OS command injection vulnerabilities in GeoVision GV-I/O Box 4E firmware 2.09 allow attackers with network access to execute arbitrary system...
- Security
CVE-2026-12846: GeoVision GV-I/O Box 4E UDP Stack Overflow (Net Mask Field)
A second critical CVSS 10.0 stack-based buffer overflow in GeoVision GV-I/O Box 4E firmware 2.09 — this time in the Net Mask field handling of the...
- Security
CVE-2025-67038: Lantronix EDS5000 OS Command Injection Vulnerability
A critical OS command injection flaw in the Lantronix EDS5000 serial device server allows unauthenticated attackers to inject arbitrary commands via the...
- Security
CVE-2026-49186: Critical MQTT Broker Wildcard ACL Bypass
A critical CVSS 9.8 vulnerability in a local MQTT broker fails to enforce topic-level ACLs, allowing any client to use wildcard characters to enumerate hidden…
- Security
Snap One WattBox 800/820 Diagnostic Auth Bypass
A CVSS 9.8 critical vulnerability in Snap One WattBox 800 and 820 series firmware exposes undisclosed diagnostic HTTP endpoints protected only by the...
- Security
CVE-2026-7154: Totolink A8000RU OS Command Injection via CGI Handler
A critical unauthenticated OS command injection vulnerability in the Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote attackers to...
- Security
CVE-2026-7037: Unauthenticated OS Command Injection in Totolink A8000RU
A critical CVSS 9.8 OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2026-21515: Azure IoT Central Elevation of Privilege
A critical CVSS 9.9 elevation of privilege vulnerability in Azure IoT Central allows an authenticated attacker to escalate privileges over a network by...
- Security
CVE-2026-6112: Totolink A7100RU OS Command Injection via setRadvdCfg
A critical OS command injection vulnerability (CVSS 9.8) in Totolink A7100RU firmware allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2026-6113: Totolink A7100RU OS Command Injection via setTtyServiceCfg
A critical OS command injection flaw (CVSS 9.8) in Totolink A7100RU enables remote unauthenticated attackers to execute arbitrary commands by manipulating...
- Security
CVE-2026-6114: Totolink A7100RU OS Command Injection via setNetworkCfg
CVE-2026-6114 is a critical OS command injection vulnerability (CVSS 9.8) in the Totolink A7100RU router's setNetworkCfg function, exploitable remotely...
- Security
CVE-2026-6115: Totolink A7100RU OS Command Injection via setAppCfg
CVE-2026-6115 describes a critical OS command injection vulnerability (CVSS 9.8) in the Totolink A7100RU router, exploitable remotely and without...
- Security
CVE-2026-4149: Sonos Era 300 Unauthenticated RCE via SMB
A CVSS 10 critical vulnerability in the Sonos Era 300 smart speaker allows unauthenticated remote attackers to execute arbitrary code by exploiting an...
- Security
CVE-2026-5977: TOTOLINK A7100RU Critical OS Command
A critical OS command injection vulnerability (CVSS 9.8) in TOTOLINK A7100RU routers allows unauthenticated remote attackers to execute arbitrary system...
- Security
CVE-2026-5978: TOTOLINK A7100RU Critical OS Command
A second critical OS command injection vulnerability (CVSS 9.8) in TOTOLINK A7100RU routers allows unauthenticated remote attackers to execute arbitrary...
- News
Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
A joint operation by the US Department of Justice, Canada, and Germany has dismantled the infrastructure behind four highly disruptive IoT botnets that...
- News
Weekly Recap: CI/CD Backdoor, FBI Buys Location Data
This week's cybersecurity roundup covers supply chain attacks hitting CI/CD pipelines, long-running IoT botnets finally disrupted, the FBI's warrantless...
- Security
Tenda A15 UploadCfg Stack Buffer Overflow (CVE-2026-4567)
A CVSS 9.8 Critical stack-based buffer overflow in Tenda A15 firmware 15.13.07.13 allows unauthenticated remote attackers to execute arbitrary code by...
- Security
D-Link DHP-1320 SOAP Handler Stack Buffer Overflow
A CVSS 8.8 stack-based buffer overflow in D-Link DHP-1320 firmware 1.00WWB04 allows unauthenticated remote attackers to execute arbitrary code via a...
- News
DoJ Disrupts 3 Million-Device IoT Botnets Behind Record
The U.S. Department of Justice, in coordination with Germany and Canada, has dismantled the C2 infrastructure of four major IoT botnets — AISURU, Kimwolf,...
- News
Massive Kimwolf Botnet Disrupts I2P Anonymous Network
IoT botnet Kimwolf launches sustained attack against The Invisible Internet Project (I2P), disrupting the encrypted, decentralized communications network...
- Security
Critical D-Link Router RCE Under Active Exploitation - No
CVE-2026-0625 allows unauthenticated remote code execution on legacy D-Link DSL routers. Devices are end-of-life with no patches forthcoming. Immediate...