CVE-2026-114353 is a vulnerability in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. It involves a hidden backdoor in the root-privileged 'assistant' daemon that allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending a specific magic string to the USB serial interface.
Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials.
This issue affects Hitachi Coding Software Suite: through 3.3.0.
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.
Multiple Supsystic Pro plugins, including google-maps-easy-pro, were distributed with malicious code via a compromised vendor update server. This allowed unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data, granting full control over affected sites. The vulnerability affects specific versions of google-maps-easy-pro prior to fixed releases.
The Premium SEO WordPress plugin contains a critical vulnerability that introduces an unauthenticated backdoor. This backdoor allows attackers to create hidden administrator accounts and, in some versions, enables remote code execution, server-side request forgery, and arbitrary front-end script or content injection. These flaws give unauthenticated attackers full control over affected sites.
The MonsterInsights Pro update distribution S3 bucket was compromised, allowing an attacker to insert a malicious file into versions 10.2.0 and 10.2.2 of the software. The malicious file, class-system-check.php, was found in three variants sharing the same encryption key, indicating a single threat actor with ongoing access. This vulnerability is classified as CWE-912 (Hidden Functionality) and has a critical CVSS score of 10. The attacker retains write access to the update distribution bucket, posing a severe risk of supply chain compromise. The product is a cloud service, and a patch is available.
Vacron VIN-DS783E-E6 contains a critical hidden functionality vulnerability (CWE-912) that allows unauthenticated remote attackers to access a concealed function and obtain administrator credentials. This vulnerability has a CVSS 4.0 score of 9.3, indicating high severity and ease of exploitation without user interaction or privileges. No patch or official remediation guidance is currently available from the vendor.
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.
The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator email address, and license key to a third-party server.
The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.
- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).
- After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration.
- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.
A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor
Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
CVE-2026-7413 is a high-severity vulnerability in Yarbo firmware version 2.3.9 involving a hidden, persistent backdoor. This backdoor allows remote access to privileged functionality without authentication or with weak authentication. It is undocumented, cannot be disabled through user settings, and persists through factory resets and normal firmware updates. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.
CVE-2026-1952 is a critical vulnerability in the Delta Electronics AS320T cloud service involving an undocumented subfunction that can cause denial of service. The vulnerability is classified under CWE-912 (Hidden Functionality). It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability without requiring privileges or user interaction. A patch is available, and since this is a cloud service, the vendor manages remediation server-side. No known exploits are reported in the wild at this time.
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23.
CVE-2026-3587 is a critical vulnerability in the WAGO Lean Managed Switch 852-1812 that allows an unauthenticated remote attacker to exploit a hidden CLI function to escape the restricted interface. This leads to full device compromise, including complete control over confidentiality, integrity, and availability. The vulnerability requires no authentication or user interaction and can be exploited remotely with low complexity. Although no known exploits are currently in the wild, the CVSS score of 10 reflects its severe impact and ease of exploitation. Organizations using this switch model are at high risk of network disruption and potential lateral movement by attackers. Immediate mitigation involves isolating affected devices and applying vendor patches once available. Countries with significant industrial automation and critical infrastructure deployments of WAGO products are most at risk. Defenders must prioritize detection of unauthorized CLI access attempts and restrict network exposure of management interfaces to trusted zones only.