Category
Network devices
11,275 known vulnerabilities.
11,275 results · Feed
-
High 7.5
DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerabil…
-
Medium 4.9
DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vuln…
-
Critical 9.8
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this …
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote att…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via cr…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter f…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigge…
-
Critical 9.8
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger t…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigg…
-
High 7.2
DrayTek VigorAP Multiple Models Buffer Overflow via setLan
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can tr…
-
High 7.2
DrayTek VigorAP Multiple Models Buffer Overflow via apautotest
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability v…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via apautotest
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulner…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via InquierTime
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via craft…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attac…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via setcamset
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via setLan
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerabil…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings
Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can t…
-
High 7.2
DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform
Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remot…
-
High 7.7CVE-2026-15469 Public exploit
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol fo…
-
High 7.1
Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially c…
-
High 7.1
Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie head…
-
High 8.5
Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling
A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger me…
-
Medium 6.3
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate t…
-
Critical 9.3CVE-2026-19586 Public exploit
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote …
-
Medium 6.0
Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate t…
-
High 7.1
Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600
An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote at…
-
High 8.5CVE-2026-75616 Public exploit
Command Injection in Router Web Management Interface
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary …
-
Medium 6.9
RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Su…
-
High 7.1
RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reb…
-
High 7.5CVE-2026-20320 Exploited
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remot…
KEV Nov 10, 2026 -
Medium 6.5
Cisco Unified Intelligence Center SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of…
-
Medium 5.0
Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability
A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device…
-
High 7.5
Cisco Secure Workload Software Security Hardening Release August 2026 - Buffer Management Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple in…
-
Critical 10.0
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple in…
-
Critical 10.0
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple in…
-
Critical 9.6
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple in…
-
Critical 9.9
Cisco Crosswork Security Hardening Release: August 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internal…
-
Critical 10.0
Cisco Crosswork Security Hardening Release: August 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internal…
-
Critical 10.0
Cisco Crosswork Security Hardening Release: August 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internal…