Live threat intelligence radar

A SQL injection vulnerability exists in funadmin version 7.1.0 in the Curd::selectList function within the /frontend/ajax/index file of the Frontend List Endpoint component. The flaw allows remote attackers to manipulate the selectFields argument to execute SQL injection attacks. Public exploit code has been released, and the vendor has not responded to disclosure attempts.

A critical stack-based buffer overflow vulnerability exists in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104, specifically in the Multi-SSID Configuration component's setWiFiMultipleConfig/delWiFiMultipleConfig functions. The flaw is triggered by manipulating the wepkey2/wepkey3 arguments via the /cgi-bin/cstecgi.cgi interface. Remote attackers can exploit this vulnerability without user interaction. Public exploit code is available.

A stack-based buffer overflow vulnerability exists in certain ASUS Router firmware versions. This flaw allows an unauthenticated attacker within network proximity to execute arbitrary commands with root privileges by sending a specially crafted device name. The vulnerability is rated high severity with a CVSS score of 8.7. No specific affected versions or patch information are provided in the available data.

A critical OS command injection vulnerability exists in Qihoo 360 devices D603-2, D600-2, D606-6, and D706 up to version 6.4.9. The flaw is in the testspeed_command function of the /fs2/bin/iscm file, allowing remote attackers to manipulate the host argument to execute arbitrary OS commands. Public exploit code is available. The vendor has not responded to disclosure requests, and no patch information is provided.

A missing authorization vulnerability in ASUS Armoury Crate allows a local attacker to write content to a specific file or registry location with Local System privileges or cause a recoverable system crash via the service's exposed inter-process interface. This flaw requires local access and does not involve user interaction. The vulnerability is identified as CVE-2026-110464 with a medium severity rating.

A command injection vulnerability exists in Qihoo 360 D603-2, D600-2, and D606-6 devices up to version 6.3.2. The flaw is in the on_push_message function of the /fs2/bin/iscm component's Timezone Push Handler, where manipulation of the tz argument can lead to remote OS command injection. This vulnerability has a CVSS score of 7.3 (high severity). The issue is resolved by upgrading to version 6.4.0, which implements a validation check for the timezone parameter.

A critical vulnerability exists in Qihoo 360 Whole Home Router M5 version 4.0.17.1566. The flaw is in the Boot Script component, specifically the Home function of /etc/init.d/mpt, which leads to hard-coded credentials. This vulnerability allows remote attackers to exploit the device without authentication. Public exploit code is available, increasing the risk of exploitation. The vendor was notified but has not responded or provided a fix.

Certain ASUS Router firmware versions contain an out-of-bounds write vulnerability that allows an unauthenticated nearby attacker to write data beyond the intended buffer. This flaw can potentially be exploited to cause a denial-of-service (DoS) condition via a crafted packet. The vulnerability is identified as CVE-2026-84729 and has a high severity rating with a CVSS score of 7.2. No specific affected versions or patch information are provided in the available data.

A critical stack-based buffer overflow vulnerability exists in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw is in the strcpy function within /cgi-bin/cstecgi.cgi, specifically in the Basic Wireless Configuration Handler component when processing the 'wepkey' argument. This vulnerability can be exploited remotely without user interaction and has a public exploit disclosed.

A critical vulnerability exists in Linksys E5600 firmware version 1.1.0.26, specifically in the /cgi-bin/mesh_login.cgi login handler component. This flaw allows remote attackers to bypass authentication, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit details available. The affected product is no longer supported by the vendor, and no patch or remediation has been provided.