Do Son TP-Link patched four critical RCE/command injection flaws in its Omada gateways. CVE-2025-6542 (CVSS 9.3) allows unauthenticated remote OS command execution. Update firmware immediately.
Command Injection
Samba released an urgent fix for a Critical (CVSS 10.0) RCE flaw (CVE-2025-10230) allowing unauthenticated command injection on AD DCs when the WINS hook is enabled. Update to 4.23.2.
Deno patched a High-severity flaw (CVE-2025-61787) allowing Command Injection on Windows when spawning batch files. Attackers can execute arbitrary commands via malicious arguments.
OpenSSH (before 10.1) has a flaw (CVE-2025-61984) that allows RCE when ProxyCommand is used. Attackers exploit control characters in usernames to inject commands.
Unit 42 disclosed a Critical unauthenticated RCE flaw (CVE-2025-52906) in TOTOLINK X6000R routers, allowing remote attackers to execute arbitrary commands. Update immediately.
Western Digital has patched a critical RCE flaw in its My Cloud NAS. The vulnerability allows remote attackers to execute arbitrary commands via a crafted HTTP request.
A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.
Libraesva has issued an urgent advisory for a command injection flaw in its ESG. The bug, which has been exploited, allows remote command execution via a malicious email.
HPE Aruba Networking has patched multiple high-severity flaws in its SD-WAN gateways. The bugs could lead to RCE, privilege escalation, and unauthorized access.
A critical flaw in a Seiko Solutions networking device allows unauthenticated remote attackers to execute commands with root privileges. The issue has a CVSS score of 9.8.
D-Link warns of a critical command injection flaw (CVSS 9.8) in its EOL DIR-series routers. A PoC is public, and since no patch is available, devices must be replaced.
A critical command injection flaw (CVE-2025-57105) has been found in D-Link's end-of-life DI-7400G+ router series. Because the devices are unsupported, no patch is coming.
Critical FortiSIEM flaw (CVE-2025-25256) allows remote unauthenticated command injection. Exploit code active in the wild—patch immediately.
CISA warns of critical flaws in EG4 Electronics inverters (CVSS up to 9.2), allowing attackers to install malicious firmware, hijack control, and disrupt power generation.
Ubiquiti has issued an advisory for a critical flaw (CVE-2025-24285, CVSS 9.8) in its UniFi Connect EV Stations, allowing remote command injection and unauthenticated RCE.
JPCERT/CC warns of critical flaws (CVSS 9.8) in SATO industrial label printers that allow unauthenticated remote attackers to upload malicious Lua scripts for root access.
CISA warns of critical flaws in Tigo Energy's Cloud Connect Advanced devices, including hard-coded credentials and command injection, that could allow remote attackers to take full control of solar systems.
Trend Micro warns of two critical RCE flaws (CVE-2025-54948, -54987) in Apex One (on-prem) actively exploited in the wild. A fix tool is available, but disables remote agent installs.
Dell patched a critical flaw (CVE-2025-36594) in DD OS allowing unauthenticated remote auth bypass. DDSH CLI flaws (CVE-2025-30096-30099) also patched.
A critical command injection flaw (CVE-2025-54418, CVSS 9.8) in CodeIgniter's ImageMagick handler allows remote code execution via malicious filenames or text.
A critical command injection flaw (CVE-2025-54416) in tj-actions/branch-names GitHub Action allows arbitrary code execution in workflows, affecting over 5,000 public repositories.
Weidmueller IE-SR-2TX series security routers have critical flaws (CVSS 9.8) allowing unauthenticated RCE and buffer overflows, risking industrial automation and critical infrastructure.