PwnOnu/T3-Technology-CPE-Advisories

Releases0

CVE-2026-35904 / CVE-2026-35905 / CVE-2026-35906 — Unauth RCE, Hardcoded Root Creds & Telnet Enable in T3 Technology CPE

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-35904 ↗	Jun 4, 2026Thursday, 4 June 2026, 15:16	—	—
Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component.
CVE-2026-35905 ↗	Jun 4, 2026Thursday, 4 June 2026, 15:16	—	—
T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the "superadmin" account.
CVE-2026-35906 ↗	Jun 4, 2026Thursday, 4 June 2026, 15:16	9.6 CRITICAL	—
An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.