Do Son TP-Link warns of two critical command injection flaws (CVE-2025-7723, -7724) in VIGI NVRs, allowing remote attackers to execute arbitrary commands, even unauthenticated. Update immediately.
Command Injection
Nokia's WaveSuite NOC platform has two severe command injection vulnerabilities (CVE-2025-24938, CVE-2025-24936) allowing remote code execution, even with low privileges.
Ubiquiti warns of CVE-2025-27212, a critical (CVSS 9.8) command injection vulnerability in UniFi Access devices, enabling unauthenticated RCE on the management network.
Four critical flaws, including unauthenticated telnet access and RCE, discovered in Nexxt Solutions NCM-X1800 mesh routers allow full network compromise. Update or disable immediately.
Multiple critical vulnerabilities (CVSS up to 9.8) in Alcatel-Lucent OmniAccess Stellar WLAN APs enable unauthenticated remote code execution and full device takeover. Patch immediately!
Schneider Electric warns of critical flaws (CVSS 10.0 RCE, SSRF, EoP) in EcoStruxure IT Data Center Expert. Patch to v9.0 immediately to prevent data center disruption.
HPE Aruba warns of critical flaws in Instant On Access Points (CVE-2025-37103) allowing unauthenticated admin bypass via hardcoded credentials and authenticated command injection.
Six critical flaws in D-Link's EOL DIR-816 routers are exposed. No patches will be issued; replace device immediately to avoid remote code execution.
A critical flaw (CVE-2025-48703) in CentOS Web Panel allows unauthenticated RCE via authentication bypass and command injection, risking over 200,000 servers.
JPCERT/CC warns of critical flaws in ELECOM wireless LAN routers, including unauthenticated RCE (CVSS 9.8) via Telnet/SOAP. Many affected models are unsupported; replace them immediately.
A critical flaw (CVE-2025-34037, CVSS 10.0) in Linksys E-Series routers allows unauthenticated remote command injection. TheMoon worm is actively exploiting it to infect devices.
Mandiant Red Team breached Aviatrix Controller via auth bypass & RCE flaws CVE-2025-2171/2172—reached root, gained AWS keys. Full chain, no guesswork.
CISA adds two actively exploited zero-days to KEV: an iOS zero-click flaw used by spyware (CVE-2025-43200) and a command injection in TP-Link routers
Five critical flaws (CVSS 9.8) in Blink routers allow unauthenticated remote root code execution via command injection in web server components.
A critical Konsole vulnerability allows arbitrary code execution via a telnet:// URL scheme. Linux users must update to 25.04.2 immediately.
Rapid7 found critical RCE flaws in MICI NetFax (versions < 3.0.1.0) via default credentials & command injection. Vendor refuses to patch, advising no internet exposure.
Serious vulnerabilities in pfSense put networks at risk. Could your firewall be hacked? Learn about the exploits and how to stay safe.
Urgent security alert! I-O DATA NAS devices vulnerable. A critical 9.8 CVSS flaw (CVE-2025-32002) enables remote command execution. Update firmware now!
Siemens RUGGEDCOM devices face CVSS 9.9 command injection flaws. Authenticated users can execute root-level code via web tools. Patch to V2.16.5 now.
PoC for CVE-2025-31644 shows how admin users can exploit F5 BIG-IP Appliance Mode to gain root access via command injection.
Two flaws in Mitel SIP phones—CVE-2025-47188 and CVE-2025-47187—enable remote command execution and file uploads, putting enterprise networks at risk.
CVE-2024-38475 and CVE-2023-44221 form an exploit chain targeting SonicWall SMA appliances, enabling remote admin hijack and code execution.