CVE-2025-26954

A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the eval function of the /www/cgi-bin/network_tools file of the Network Tools CGI component. Manipulation of the sid argument results in OS command injection. The attack can be performed remotely and the exploit has been made public.

A security flaw was discovered in FAST FAC1203R 20200116_2.0.4 in the _tWlanTask function of the MmtAtePrase Parser component. Manipulation results in a stack-based buffer overflow. The attacker must have access to the local network, and the exploit has been released.

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0 in an unknown function of the /api/ZRnetwork/set_passwd file. Manipulation of the password1 argument causes command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0 in some unknown processing of the /api/ZRQos/set_online_client file. Manipulation of the mac argument results in command injection. The attack can be launched remotely and the exploit has been made public.

A vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 affects unknown code in the file /api/ZRQos/set_online_client. Manipulation of the argument ip leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

A flaw in Ziroom ZHOME A0101 version 1.0.1.0 affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Manipulation of the argument login_pwd leads to command injection. The attack can be performed remotely, and the exploit is published.

A vulnerability was detected in Ziroom ZHOME A0101 version 1.0.1.0, affecting unknown functionality of the file /api/ZRnetwork/firstLogin. Manipulation of the argument firstLogin results in command injection. The attack can be performed remotely, and the exploit is public.

PyJWT is a Python implementation of JSON Web Token standards. Prior to version 2.14.0, is_pem_format in jwt/utils.py does not recognize every PEM representation accepted by the cryptography loader. When an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. An attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

A weakness in Ziroom ZHOME A0101 version 1.0.1.0 affects the function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua of the USB Device Management API component. Manipulation of the argument path causes command injection. The attack can be performed remotely, and the exploit is publicly available.