CVE Vulnerability Advisory Database

[Affected Scope] SonicWall firewall appliances running SonicOS 7.x and 6.5.x with SSLVPN service enabled.

[Impact] Attackers with valid credentials for alternate authentication methods can bypass SAML controls and enforced MFA to gain unauthorized network access.

[Mitigation] Immediately apply the latest firmware updates provided by SonicWall and audit SSLVPN access logs for suspicious activity.

[Affected Scope] Ivanti Connect Secure versions prior to 25.1.1.3 and 22.8R2.6

[Impact] Authenticated attackers can upload malicious files to predictable paths, potentially leading to persistent access or further exploitation

[Mitigation] Immediate upgrade to versions 25.1.1.3, 22.8R2.6, or higher is required

[Affected Scope] WAVLINK WL-WN530HG4B router with firmware version M_V260724.

[Impact] Authenticated remote attackers can exploit the 'Name' parameter within the port forwarding function of '/cgi-bin/wapi.cgi' to execute arbitrary OS commands with root privileges.

[Mitigation] Restrict access to the router's management interface, apply firewall rules to block malicious payloads, and upgrade to the latest patched firmware version.

[Affected Scope] Wavlink WN579X3-D V250402 firmware version.

[Impact] An authenticated remote attacker can manipulate the 'Name' parameter in the port forwarding configuration API to execute arbitrary OS commands with root privileges.

[Mitigation] Restrict external access to the router's management interface and apply the latest firmware patch from the vendor immediately.

[Affected Scope] WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4 and prior.

[Impact] Unauthenticated remote attackers can inject malicious OS commands to gain full root-level control over the device and compromise the internal network.

[Mitigation] Disable remote WAN management, restrict access to the administration interface, and monitor network traffic for suspicious CGI requests.

[Affected Scope] D-Link DIR-505 firmware version 1.10B02 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands or gain full control of the device by sending crafted filenames via TFTP

[Mitigation] Disable the vulnerable TFTP service immediately, restrict access via firewall rules, and upgrade to a patched firmware or replace the legacy device

[Affected Scope] Opengear IM72XX, CM71XX, and ACM70XX console server appliances running firmware versions 4.8.0 through 5.5.2

[Impact] Unauthenticated remote attackers can crash the index.cgi process or potentially execute arbitrary code via a crafted multipart/form-data POST request

[Mitigation] Immediately upgrade to firmware version 5.5.3 or later, which contains the official security patch

[Affected Scope] Cisco ASA and FTD Software with Remote Access SSL VPN enabled and secondary authentication configured.

[Impact] Unauthenticated remote attackers can trigger an unexpected device reload, leading to a complete Denial of Service (DoS) of VPN services.

[Mitigation] Apply the latest security patches from Cisco immediately; review secondary authentication configurations if patching is delayed.

[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).

[Impact] Authenticated users can escalate to 'superuser operator' privileges, leading to full system compromise and data breach.

[Mitigation] Apply official security patches immediately and restrict network access to the management interface.

[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.

[Impact] Local attackers can manipulate DSCache configuration to gain root privileges and full system control.

[Mitigation] Apply the latest security patches from Ivanti and run the Integrity Checker Tool (ICT).

[Affected Scope] Internal messaging components of BeyondTrust Remote Support appliances.

[Impact] Unauthenticated remote attackers can bypass authentication via origin spoofing to perform arbitrary file operations, leading to full system compromise.

[Mitigation] Immediately apply the vendor-provided security patch (KB0024066) and restrict access to the management interface.

[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS

[Impact] An authenticated attacker with network access can execute arbitrary code with root privileges, leading to full system compromise

[Mitigation] Apply the latest security patches immediately and restrict management interface access to trusted internal IP addresses only

[Affected Scope] All versions of Cisco Secure Email Gateway with Advanced Malware Protection (AMP) and File Reputation service enabled.

[Impact] An unauthenticated remote attacker can overwrite system files and execute arbitrary commands with root privileges by sending a crafted email attachment.

[Mitigation] Immediately apply the official AsyncOS security patches provided by Cisco. If patching is not possible, disable the AMP File Reputation feature as a temporary workaround.

[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)

[Impact] Remote unauthenticated attackers can bypass authentication via identity spoofing and execute arbitrary commands with system privileges

[Mitigation] Immediately upgrade to version 25.1.3.0 or later and perform a comprehensive compromise assessment using official IoCs

[Affected Scope] NetScaler ADC and Gateway versions prior to 14.1-73.41 and 13.1-64.28.

[Impact] Unauthenticated remote attackers can cause a Denial of Service (DoS) and system crash by sending specially crafted packets.

[Mitigation] Immediately apply the latest security patches provided by Citrix.

[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.

[Impact] Unauthenticated remote attackers can write arbitrary files via crafted HTTP/HTTPS requests, leading to full system compromise and Remote Code Execution (RCE).

[Mitigation] Immediately upgrade to patched firmware versions (8.0.2, 7.6.7, etc.) and restrict access to administrative interfaces.

[Affected Scope] Cisco Catalyst SD-WAN Manager (formerly vManage) software

[Impact] An unauthenticated, remote attacker can bypass authentication mechanisms and gain full administrative access to the system via crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to management interfaces using ACLs.

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP editions.

[Impact] Unauthenticated remote attackers can exploit memory buffer vulnerabilities (CWE-119) to achieve Remote Code Execution (RCE) or trigger a Denial of Service (DoS).

[Mitigation] This vulnerability is listed in CISA KEV and is actively exploited; immediately update to the latest patched firmware versions.

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges, leading to full appliance compromise and potential lateral movement.

[Mitigation] Immediately apply the vendor-supplied security patches and restrict access to management interfaces (NSIP).

[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.

[Impact] Unauthenticated attackers can execute arbitrary code with system privileges via specially crafted traffic, leading to full system compromise.

[Mitigation] Immediately apply the latest security patches or Hotfixes provided by F5, and consider disabling the OAuth Authorization Server profile until patched.