#Router
All CosmicBytez Labs articles tagged #Router, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-109110: Wavlink WL-WN592AX6 Unauthenticated OS Command Injection
A critical, unauthenticated command injection in Wavlink WL-WN592AX6 routers lets remote attackers run arbitrary OS commands as root.
- Security
CVE-2026-108929: Netcore NR268 Router DDNS Argument Injection
A CVSS 9.9 argument injection flaw in Netcore NR268 router firmware lets remote attackers hijack the DDNS Hostname field to run arbitrary commands.
- Security
CVE-2026-108576: Unauthenticated OS Command Injection in TOZED X300 Router (CVSS 10.0)
A maximum-severity flaw in TOZED X300 firmware ≤ 6.01.3 lets unauthenticated attackers inject OS commands via the IPPingDiagnostics Host field.
- Security
CVE-2026-105110: Iskratel Innbox GPON ONT Unauthenticated OS Command Injection
Unauthenticated OS command injection in Iskratel Innbox GPON ONT's login.xgi endpoint lets remote attackers execute commands as root.
- Security
Critical Stack Overflow in FAST FAC1200R Routers Has Public Exploit
CVE-2026-101037 lets remote attackers crash or hijack FAST FAC1200R routers via the devdiscover service; a public exploit exists and no patch is available.
- Security
D-Link DIR-895L L2TP Parser Out-of-Bounds Write (CVE-2026-100740)
A CVSS 9.9 pre-auth out-of-bounds write in D-Link DIR-895L's L2TP control-channel parser has a public PoC and no vendor patch.
- Security
CVE-2026-96891: D-Link DIR-825 rp-l2tp Out-of-Bounds Write Enables Remote Compromise
A critical, unauthenticated out-of-bounds write in D-Link DIR-825's L2TP tunnel handling has no patch — the router is end-of-life.
- Security
CVE-2026-93742: Totolink A3002MU Command Injection via formWsc
Public PoC exploits an unauthenticated command injection in Totolink A3002MU's WPS handler, giving remote attackers root on the router.
- Security
Totolink A3002MU Router Buffer Overflow Enables Remote Attacks
CVE-2026-93741 (CVSS 10) lets remote attackers overflow a buffer in the Totolink A3002MU's web admin interface. Public exploit code, no patch yet.
- Security
Tenda HG10 Routers Hit By Critical Unauthenticated Buffer Overflow
A critical buffer overflow in Tenda HG10 firmware's formURL function allows remote memory corruption with a public exploit and no patch yet.
- Security
Tenda HG10 formgponConf Flaw Allows Unauthenticated Root Command Injection
A near-maximum-severity OS command injection in Tenda HG10's formgponConf function lets attackers run root commands remotely; no patch is available.
- Security
CVE-2026-38577: Tenda HG21 Hardcoded Admin Credentials
Hardcoded admin credentials baked into Tenda HG21 firmware let attackers bypass authentication and gain full root access to the router.
- Security
Critical Unauthenticated Buffer Overflow in Tenda HG10 Routers
CVE-2026-82542 (CVSS 10) lets remote attackers trigger a buffer overflow in Tenda HG10 routers via the formIPv6Routing handler. Public exploit exists.
- Security
D-Link DIR-825M Disk-Format Stack Overflow (CVE-2026-82592)
CVE-2026-82592 is a critical, unauthenticated stack overflow in D-Link DIR-825M's disk-formatting endpoint, with a public exploit available.
- Security
D-Link DIR-825M LTE Upgrade Stack Overflow (CVE-2026-82593)
CVE-2026-82593 is a critical, unauthenticated stack overflow in D-Link DIR-825M's LTE firmware-upgrade handler, with a public exploit available.
- Security
CVE-2026-19961: Critical Buffer Overflow in Edimax EW-7478APC Wireless Router
A CVSS 9.9 buffer overflow in the Edimax EW-7478APC 1.04 allows unauthenticated remote code execution via the formWlSiteSurvey endpoint.
- Security
CVE-2026-19977: EFM ipTIME A3004T Authentication Bypass — CVSS 10.0
Critical auth bypass (CVSS 10.0) in EFM ipTIME A3004T routers lets unauthenticated attackers gain full admin access via session URL manipulation.
- News
New Evooo1Bot Linux Botnet Turns Routers Into Traffic Relay Nodes
FortiGuard Labs uncovers Evooo1Bot, a Mirai-derived Linux botnet exploiting 8 CVEs to compromise routers and convert them into persistent SOCKS5 relay proxies.
- News
Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
This week's security roundup covers agentic AI containment failures, a critical Metabase zero-day, malicious MCP plugins targeting AI assistants, and...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Quectel)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Fibocom)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via Ping Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host parameter...
- Security
D-Link DWR-M961 Command Injection via Traceroute Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host and ipVer...
- Security
MSI Radix AXE6600 Critical Command Injection in WPS Interface (CVE-2026-71983)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's wps.cgi interface allows remote attackers to execute arbitrary...
- Security
MSI Radix AXE6600 Critical Command Injection in URL Filter Function (CVE-2026-71984)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's urlfilter function allows remote attackers to execute arbitrary...
- Security
MSI Radix AXE6600 Critical Command Injection in Access Control Function (CVE-2026-71985)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's accesscontrol function enables remote attackers to execute arbitrary...
- Security
MSI Radix AXE6600 Critical Command Injection in DMZ Function (CVE-2026-71986)
A critical CVSS 9.8 command injection vulnerability in the MSI Radix AXE6600 router's DMZ function allows remote attackers to execute arbitrary commands...
- Security
CVE-2026-66747: Zbtlink Routers Ship ENDLESSDOORS Firmware Backdoor (CVSS 9.8)
Every published Zbtlink router firmware build contains ENDLESSDOORS — an embedded root-level remote control implant disguised as a Linux kernel worker...
- Security
CVE-2026-18602: GL.iNet GL-MT3000 Remote Command Injection via VPN Hostname
A critical command injection vulnerability in GL.iNet GL-MT3000 routers (firmware up to 4.4.5) allows remote attackers to execute arbitrary OS commands by...
- Security
CVE-2024-51311: Critical Stack Overflow in Tenda TX9 Router Firmware
A critical stack overflow vulnerability (CVSS 9.8) in Tenda TX9 firmware V22.03.02.05 allows remote attackers to execute arbitrary code via a crafted...
- Security
CVE-2026-51380: Tenda AC10 v3 Buffer Overflow Enables DoS and Remote Code Execution
A critical CVSS 9.8 buffer overflow vulnerability in Tenda AC10 v3 firmware V03.03.16.09 allows remote attackers to cause permanent denial of service or...
- Security
CVE-2026-15511: Critical OS Command Injection in Comfast CF-WR631AX Router
A CVSS 9.8 critical OS command injection vulnerability in the Comfast CF-WR631AX V3 router allows unauthenticated network-adjacent attackers to execute...
- Security
CVE-2026-35906: T3 Technology CPE Unauthenticated Root RCE via Debug CGI
An undocumented debug CGI endpoint in T3 Technology CPE devices (T625Pro v1.0.07, T6825G v1.0.03) allows unauthenticated remote attackers to execute arbitrary…
- Security
CVE-2026-6274: Critical Authentication Bypass in DTS Redline WR3200 Router
A critical authentication bypass vulnerability in the DTS Electronics Redline WR3200 router allows unauthenticated attackers to access functionality protected…
- Security
CVE-2026-10187: Totolink N300RH Stack Buffer Overflow in WiFi Config
A critical-severity stack buffer overflow in the Totolink N300RH wireless router allows remote attackers to execute arbitrary code via a crafted KeyStr…
- Security
Critical Stack-Based Buffer Overflow in Totolink NR1800X
A critical CVSS 9.8 stack-based buffer overflow in the Totolink NR1800X router's lighttpd component allows unauthenticated remote code execution via a...
- Security
CVE-2026-36841: TOTOLINK N200RE V5 Command Injection
A critical CVSS 9.8 command injection vulnerability in TOTOLINK N200RE V5 allows unauthenticated remote code execution via the macstr and bandstr...
- Security
CVE-2026-7136: Totolink A8000RU OS Command Injection via setDmzCfg
A critical OS command injection vulnerability in the Totolink A8000RU router allows remote attackers to execute arbitrary commands by manipulating the...
- Security
CVE-2026-7154: Totolink A8000RU OS Command Injection via CGI Handler
A critical unauthenticated OS command injection vulnerability in the Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote attackers to...
- Security
CVE-2026-7037: Unauthenticated OS Command Injection in Totolink A8000RU
A critical CVSS 9.8 OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2025-29635: D-Link DIR-823X Command Injection
A command injection flaw in end-of-life D-Link DIR-823X routers allows authenticated remote attackers to execute arbitrary OS commands. CISA has added...
- Security
CVE-2026-6112: Totolink A7100RU OS Command Injection via setRadvdCfg
A critical OS command injection vulnerability (CVSS 9.8) in Totolink A7100RU firmware allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2026-6113: Totolink A7100RU OS Command Injection via setTtyServiceCfg
A critical OS command injection flaw (CVSS 9.8) in Totolink A7100RU enables remote unauthenticated attackers to execute arbitrary commands by manipulating...
- Security
CVE-2026-6114: Totolink A7100RU OS Command Injection via setNetworkCfg
CVE-2026-6114 is a critical OS command injection vulnerability (CVSS 9.8) in the Totolink A7100RU router's setNetworkCfg function, exploitable remotely...
- Security
CVE-2026-6115: Totolink A7100RU OS Command Injection via setAppCfg
CVE-2026-6115 describes a critical OS command injection vulnerability (CVSS 9.8) in the Totolink A7100RU router, exploitable remotely and without...
- Security
CVE-2026-5977: TOTOLINK A7100RU Critical OS Command
A critical OS command injection vulnerability (CVSS 9.8) in TOTOLINK A7100RU routers allows unauthenticated remote attackers to execute arbitrary system...
- Security
CVE-2026-5978: TOTOLINK A7100RU Critical OS Command
A second critical OS command injection vulnerability (CVSS 9.8) in TOTOLINK A7100RU routers allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2026-31027: TOTOlink A3600R Buffer Overflow in setAppEasyWizardConfig
A critical CVSS 9.8 buffer overflow in TOTOlink A3600R v5.9c.4959 allows remote attackers to exploit the rootSsid parameter in the setAppEasyWizardConfig...
- Security
Tenda A15 UploadCfg Stack Buffer Overflow (CVE-2026-4567)
A CVSS 9.8 Critical stack-based buffer overflow in Tenda A15 firmware 15.13.07.13 allows unauthenticated remote attackers to execute arbitrary code by...
- Security
D-Link DHP-1320 SOAP Handler Stack Buffer Overflow
A CVSS 8.8 stack-based buffer overflow in D-Link DHP-1320 firmware 1.00WWB04 allows unauthenticated remote attackers to execute arbitrary code via a...
- Security
Cisco IOS XE Web UI Privilege Escalation Actively Exploited
Cisco discloses a high-severity privilege escalation vulnerability in IOS XE Web UI that allows authenticated users to gain root access. Active...
- Security
Critical D-Link Router RCE Under Active Exploitation - No
CVE-2026-0625 allows unauthenticated remote code execution on legacy D-Link DSL routers. Devices are end-of-life with no patches forthcoming. Immediate...