CVE Vulnerability Catalog

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to expose WAN-side administration via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setLedCfg function of TOTOLINK T6 allows unauthenticated attackers to modify LED behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to change the administrator account via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 allows unauthenticated attackers to change UPnP service state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 allows unauthenticated attackers to alter access-device policies via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure uplink settings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to configure forced reboot tasks via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the roaming enablement flag via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getPairCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. It affects an unknown function in the file /cgi-bin/isomount_mgr.cgi of the ISO Image Handler component. Manipulation of the argument upIsoRootPath results in OS command injection. The attack can be executed remotely, and the exploit is public.

D-Link DNS-340L and DNS-345 (versions 1.01B04/1.03B06/1.04.B02/1.05b04) have a vulnerability in /cgi-bin/virtual_vol.cgi (Virtual Volume Handler). Manipulation of arguments f_sharename/f_target/f_name leads to OS command injection. Remote exploitation is possible, and the exploit has been publicly disclosed.

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash. They can also gain root privileges to steal configuration passwords (e.g., SNMP) and tamper with critical system parameters, leading to abnormal operation of the entire power system.

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose schemas, plant malicious tables, corrupt schemas, or permanently destroy data.