CVE-2026-35906

Published June 4th, 2026

View on NVD ↗

CVSS v3

9.6

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.

PwnOnu/T3-Technology-CPE-Advisories

CVE-2026-35904 / CVE-2026-35905 / CVE-2026-35906 — Unauth RCE, Hardcoded Root Creds & Telnet Enable in T3 Technology CPE

GitHub