#Router Security
All CosmicBytez Labs articles tagged #Router Security, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-120189: D-Link DIR-505 TFTP Upload Filename Buffer Overflow
A critical stack-based buffer overflow in the tftpd upload filename handler of D-Link DIR-505 1.10B02 can be triggered remotely. CVSS 10.0.
- Security
CVE-2026-120195: WAVLINK WL-WN579A3-A Setup Wizard Command Injection
A critical OS command injection in the Initial Setup Wizard of the WAVLINK WL-WN579A3-A lets attackers run commands through the wlan_ssid argument. CVSS 10.0.
- Security
CVE-2026-120196: WAVLINK WN579X3-D port_forward Command Injection
A critical OS command injection in the port_forward function of the WAVLINK WN579X3-D is remotely exploitable and a public exploit exists. CVSS 9.9.
- Security
CVE-2026-120197: WAVLINK WL-WN530HG4B port_forward Command Injection
A critical OS command injection in the port_forward function of the WAVLINK WL-WN530HG4B is remotely exploitable and a public exploit exists. CVSS 9.9.
- Security
CVE-2026-120198: WAVLINK WL-WN530BE1-A protocol.csp Command Injection
A maximum-severity command injection in con_check_read_finish of the WAVLINK WL-WN530BE1-A is remotely exploitable and has been publicly disclosed. CVSS 10.0.
- News
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
Researcher Quentin Kaiser found an unpatched Broadcom WPS flaw letting attackers in Wi-Fi range run root code with no password on millions of routers.
- Security
CVE-2026-108895: Linksys E1700 setDMZ OS Command Injection
A public exploit targets Linksys E1700 routers via the setDMZ goform handler, letting remote attackers inject OS commands through the MAC_addr parameter.
- Security
CVE-2026-108896: Linksys E1700 setLinksysIpv6 OS Command Injection
The Linksys E1700's IPv6 configuration handler injects the 6rd_prefix parameter into a shell command, letting remote attackers run arbitrary code.
- Security
CVE-2026-94952: Critical Unauthenticated Stack Overflow in TOTOLINK N150RT Routers
CVSS 9.8 unauthenticated stack overflow in TOTOLINK N150RT's formPortFw handler risks remote crash or code execution; no patch exists for this EOL router.
- Security
CVE-2026-101074: Netcore NR289-GE Pre-Authentication Stack Buffer Overflow
A critical pre-auth stack buffer overflow in Netcore NR289-GE routers lets remote attackers crash the device or potentially achieve RCE.
- Security
CVE-2026-101075: Netcore NR289-GE Unauthenticated OS Command Injection
A critical OS command injection in Netcore NR289-GE routers lets unauthenticated attackers execute root commands via location_time.cgi.
- Security
CVE-2026-101076: Netcore NR289-GE Router Unauthenticated OS Command Injection
A critical, unauthenticated OS command injection in Netcore NR289-GE routers has a public exploit, letting remote attackers run commands as root.
- Security
CVE-2026-101077: Netcore NR289-GE Authentication Bypass in the boa_temp Handler
A critical, CVSS 10 missing-authentication flaw in Netcore NR289-GE routers has a public exploit and an unresponsive vendor, with no patch in sight.
- Security
CVE-2026-101000: Missing Authorization in Netcore NBR100V2 ACL Handler
Netcore NBR100V2's ACL handler skips authorization on uci.apply, letting unauthenticated attackers tamper with device configuration remotely.
- Security
CVE-2026-101001: Netcore NBR200V2 Web Management Interface OS Command Injection via network_tools
Unauthenticated OS command injection in Netcore NBR200V2's network_tools CGI handler via QUERY_STRING gives remote attackers root-level code execution.
- Security
CVE-2026-101002: Netcore NBR200V2 Tools Ping Handler OS Command Injection
Netcore NBR200V2's Ping diagnostic tool injects an unsanitized url argument into a system() call, enabling remote command injection.
- News
D-Link Warns of Max Severity Zero-Day Bug in DIR-822A Routers
D-Link disclosed two unpatched flaws in legacy DIR-822A routers with public PoC exploit code, including a max-severity DHCP stack overflow.
- Security
CVE-2026-94003: Perfect-10 Stack Buffer Overflow in Comfast CF-N1-S Routers
Comfast CF-N1-S 2.6.0.1's mbox-config CGI handler allows unauthenticated, network-based stack buffer overflow scoring a maximum CVSS 10.0.
- Security
CVE-2026-94089: Critical Unauthenticated Stack Overflow in D-Link DIR-868L Routers
A CVSS 10 stack-based buffer overflow in D-Link DIR-868L's authentication CGI lets unauthenticated remote attackers achieve full router compromise.
- Security
CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
An unauthenticated command injection in Netcore NBR200V2's traceroute tool lets attackers run arbitrary commands as root via ubus JSON-RPC.
- Security
CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
Netcore NBR200V2 routers are vulnerable to unauthenticated command injection via the ipv4 argument in the LAN IP configuration handler.
- Security
CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
A third command injection flaw in Netcore NBR200V2's network_tools CGI endpoint lets remote attackers run arbitrary shell commands unauthenticated.
- Security
CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
Netcore NBR200V2's firmware upgrade CGI endpoint injects the QUERY_STRING argument into a shell command, enabling unauthenticated remote injection.
- Security
CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
The restore.cgi backup-restore endpoint on Netcore NBR200V2 routers is vulnerable to unauthenticated command injection via QUERY_STRING.
- Security
CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration
A buffer overflow in Netcore NBR200V2's routerd WAN VLAN handler can be triggered remotely via the vlan_wanX.ports argument.
- Security
CVE-2026-93958: D-Link R95 (BE9500) Command Injection to Root RCE
A public PoC chains D-Link R95 BE9500 firmware 1.00.16's SetTimeSettings handler into authenticated command injection for root shell access.
- Security
Critical Stack Overflow in D-Link DIR-823G Routers (CVE-2026-90680)
An unauthenticated stack-based buffer overflow (CVSS 9.9) in D-Link DIR-823G's HNAP1 interface allows remote attackers to corrupt memory...
- Security
CVE-2026-89009: WAVLINK Router Unauthenticated Arbitrary File Write
WAVLINK WN535M1/WN535M3 routers let unauthenticated attackers overwrite any file on the device via the root sync_server daemon.
- Security
CVE-2026-89010: WAVLINK Router Unauthenticated Root Command Injection
A critical OS command injection in WAVLINK WN535M1/WN535M3 routers lets unauthenticated attackers run root commands via sync_server.
- News
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
CERT Polska warns of active attacks gaining full admin control of internet-facing MikroTik RouterOS devices via SSH with no authentication needed.
- Security
TOTOLINK A720R Router: Unauthenticated Memory Corruption RCE (CVE-2026-82539)
CVE-2026-82539 (CVSS 9.4) lets remote attackers corrupt memory in TOTOLINK A720R routers via the MAC filtering CGI handler. Public PoC exists.
- Security
CVE-2026-78050: Critical Stack Buffer Overflow in Comfast CF-N1-S Router
CVSS 9.9 stack overflow in Comfast CF-N1-S 2.6.0.1 NTP timezone endpoint enables unauthenticated remote code execution.
- Security
CVE-2026-71948: D-Link DWR-M961 Command Injection via formDebugDiagnosticRun
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers allows remote attackers to execute arbitrary commands via the host...
- Security
CVE-2026-71949: D-Link DWR-M961 Command Injection via formUSSDSetup
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers enables remote code execution through the ussdValue and...
- Security
CVE-2026-71950: D-Link DWR-M961 Command Injection via formSmsManage
A critical unauthenticated command injection in the D-Link DWR-M961 SMS management interface allows remote attackers to execute arbitrary OS commands via...
- Security
CVE-2026-71951: D-Link DWR-M961 Command Injection via formIMEISetup
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers allows remote code execution by injecting OS commands into the...
- Security
CVE-2026-52186: Critical SQL Injection RCE in UTT nv518G Router
A critical SQL injection vulnerability (CVSS 9.8) in the UTT nv518G router allows unauthenticated remote attackers to execute arbitrary code via the...
- News
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
Researchers at QiAnXin's XLab have identified AryStinger, a novel malware targeting end-of-life D-Link routers and QNAP NAS devices to build a distributed...
- News
Acer Working to Patch Max Severity Zero-Days in Wave 7 Routers
Acer is scrambling to address two maximum-severity zero-day vulnerabilities discovered in its Wave 7 mesh router lineup. Both flaws carry a CVSS score of 10.0…
- News
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI
This week's threat intelligence bulletin covers Linux rootkit campaigns, an actively exploited router zero-day, AI-assisted intrusions, new scam kit...
- News
Authorities Disrupt APT28 Router DNS Hijacks Targeting
An international law enforcement operation has dismantled FrostArmada, an APT28 campaign that hijacked DNS on compromised MikroTik and TP-Link routers to...
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...