CVE-2026-35906
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07 and T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via a crafted HTTP query string.
Risk Assessment
An attacker can gain full control over the device, potentially compromising the confidentiality, integrity, and availability of data and services.
Recommendation
Remove or disable the undocumented debug CGI endpoint and update the firmware to a version without this vulnerability.
Other vulnerabilities in T3 Technology CPE
See all- CVE-2026-35905Critical
T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the 'superadmin' account.
- CVE-2026-35904Critical
Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via a crafted request to a vulnerable CGI component.
Original NVD description (English source)
An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS