RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN.

Published Jan 16, 2025 · Updated Jul 7, 2026 · Assigned by mitre