CVE-2026-35906

CriticalCVSS 9.6

Published: 04/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07 and T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via a crafted HTTP query string.

Risk Assessment

An attacker can gain full control over the device, potentially compromising the confidentiality, integrity, and availability of data and services.

Recommendation

Remove or disable the undocumented debug CGI endpoint and update the firmware to a version without this vulnerability.

Original NVD description (English source)

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.