CVE-2026-7674

HighCVSS 8.8

Published: 03/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

41th percentile - higher than 41% of all known CVEs

Summary

A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to version 1.2.8 in the start_single_service function of the Web Management Interface. Manipulating the arguments vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow.

Risk Assessment

An attacker can remotely exploit this vulnerability, posing a serious threat to the security of the system and user data.

Recommendation

It is recommended to update the devices to the latest software version to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Web Management Interface

CVE-2025-6541High
An arbitrary OS command may be executed on the product by a user who can log in to the web management interface.

Original NVD description (English source)

A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS