Summermu/VulnForIoT

Releases0

Stars2

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-50757 ↗	Sep 2, 2025Tuesday, 2 September 2025, 15:15	6.5 MEDIUM	—
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-50755 ↗	Sep 2, 2025Tuesday, 2 September 2025, 15:15	6.5 MEDIUM	—
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-50756 ↗	Jul 14, 2025Monday, 14 July 2025, 15:15	9.8 CRITICAL	—
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44877 ↗	May 2, 2025Friday, 2 May 2025, 15:15	9.8 CRITICAL	—
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44872 ↗	May 2, 2025Friday, 2 May 2025, 15:15	9.8 CRITICAL	—
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44868 ↗	May 2, 2025Friday, 2 May 2025, 15:15	9.8 CRITICAL	—
Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44865 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.3 MEDIUM	—
Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44867 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.3 MEDIUM	—
Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44866 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.3 MEDIUM	—
Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44861 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.3 MEDIUM	—
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44863 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.5 MEDIUM	—
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44860 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.5 MEDIUM	—
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44864 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.3 MEDIUM	—
Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44862 ↗	May 1, 2025Thursday, 1 May 2025, 18:15	6.3 MEDIUM	—
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44848 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44847 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.3 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44839 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44846 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.3 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44845 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44844 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44843 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44842 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44841 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44840 ↗	May 1, 2025Thursday, 1 May 2025, 17:15	6.5 MEDIUM	—
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44854 ↗	May 1, 2025Thursday, 1 May 2025, 14:15	6.3 MEDIUM	—
TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.