CVE Vulnerability Advisory Database

[Affected Scope] D-Link DIR-505 firmware version 1.10B02 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands or gain full control of the device by sending crafted filenames via TFTP

[Mitigation] Disable the vulnerable TFTP service immediately, restrict access via firewall rules, and upgrade to a patched firmware or replace the legacy device

[Affected Scope] ethos utility in RIOT OS versions up to and including 2026.01-devel-317

[Impact] Unauthenticated remote attackers can send crafted serial or TCP-framed input to corrupt memory, leading to application crashes or potential arbitrary code execution

[Mitigation] Apply the latest source code patches, or manually implement bounds checking in the ethos utility's frame parser and rebuild

[Affected Scope] RIOT OS versions up to and including 2026.01-devel-317 containing the tapslip6 utility

[Impact] Attackers can trigger a stack buffer overflow via crafted command-line arguments, leading to process crashes and potential arbitrary code execution

[Mitigation] Apply the latest source patches, replace unsafe string functions with snprintf, and restrict execution permissions on the tapslip6 binary

[Affected Scope] Virtual servers configured with a BIG-IP APM (Access Policy Manager) access policy

[Impact] Unauthenticated remote attackers can execute arbitrary code (RCE) with high privileges by sending specially crafted malicious network traffic

[Mitigation] Immediately apply the latest security patches provided by F5, and restrict access to APM virtual servers until patched

[Affected Scope] Multiple Fortinet appliance product lines including FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with root privileges by sending crafted HTTP requests containing a malicious hash cookie

[Mitigation] Immediately upgrade to the patched firmware versions provided by the vendor and restrict external access to management interfaces

[Affected Scope] All mail server environments running Qualitia Active! mail 6 BuildInfo: 6.60.05008561 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code or trigger a Denial-of-Service (DoS) condition by sending specially crafted HTTP requests

[Mitigation] Immediately apply the latest security patch provided by the vendor (Qualitia) and restrict external access to the webmail interface until patched

[Affected Scope] Ivanti Connect Secure (before 22.7R2.6), Policy Secure (before 22.7R1.4), and ZTA Gateways (before 22.8R2.2)

[Impact] Unauthenticated remote attackers can trigger a stack-based buffer overflow to execute arbitrary code with root privileges on the target gateway

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to external-facing management interfaces

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-0282

[Impact] A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software to fully compromise the device

[Mitigation] Immediately apply the latest firmware patches provided by Cisco and disable remote WAN management access

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise via the SSL VPN gateway

[Mitigation] Immediately upgrade to the latest patched firmware versions provided by Cisco, and restrict access to the SSL VPN port from untrusted networks

[Affected Scope] SonicWall SMA 200, 210, 400, 410, and 500v appliances running firmware versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv, and earlier

[Impact] A remote unauthenticated attacker can execute arbitrary code with 'nobody' user privileges on the appliance by sending a specially crafted HTTP request, potentially leading to full system compromise

[Mitigation] Immediately upgrade the appliance firmware to the patched version (10.2.1.3-27sv or higher) and restrict external access to the management interface

[Affected Scope] IoT and network devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B

[Impact] Unauthenticated remote attackers can exploit stack buffer overflows and command injection flaws to execute arbitrary code with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware updates from the respective device manufacturers and restrict external access to the web management interface