CVE Vulnerability Advisory Database

[Affected Scope] WAVLINK WN701AE router devices running firmware version M01AE_V260105

[Impact] Authenticated remote attackers can execute arbitrary OS commands via the web management interface, leading to complete device compromise

[Mitigation] Restrict external access to the web administration interface and apply firmware updates or implement strict firewall access control lists (ACLs)

[Affected Scope] WAVLINK WL-WN530HG4B router with firmware version M_V260724.

[Impact] Authenticated remote attackers can exploit the 'Name' parameter within the port forwarding function of '/cgi-bin/wapi.cgi' to execute arbitrary OS commands with root privileges.

[Mitigation] Restrict access to the router's management interface, apply firewall rules to block malicious payloads, and upgrade to the latest patched firmware version.

[Affected Scope] Wavlink WN579X3-D V250402 firmware version.

[Impact] An authenticated remote attacker can manipulate the 'Name' parameter in the port forwarding configuration API to execute arbitrary OS commands with root privileges.

[Mitigation] Restrict external access to the router's management interface and apply the latest firmware patch from the vendor immediately.

[Affected Scope] WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4 and prior.

[Impact] Unauthenticated remote attackers can inject malicious OS commands to gain full root-level control over the device and compromise the internal network.

[Mitigation] Disable remote WAN management, restrict access to the administration interface, and monitor network traffic for suspicious CGI requests.

[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands by manipulating API arguments, leading to full system compromise

[Mitigation] Immediately upgrade to version 9.15.2.70 or 10.3.4.45 or later

[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted API requests, leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to the management API

[Affected Scope] Sangfor Operation and Maintenance Management System up to version 3.0.12

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with elevated privileges by sending specially crafted requests

[Mitigation] Restrict external access to the vulnerable endpoint, apply firewall/WAF rules, and monitor for official vendor patches

[Affected Scope] License Servlet component of Fortra GoAnywhere MFT

[Impact] Unauthenticated attackers with a validly forged license response signature can deserialize arbitrary objects, potentially leading to remote command injection and full system compromise

[Mitigation] Immediately apply the official security patches provided by Fortra and restrict external access to the license servlet interfaces

[Affected Scope] DrayTek Vigor2960 and Vigor300B gateway devices running firmware version 1.5.1.4 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges via the Web Management Interface, leading to full system compromise

[Mitigation] Immediately upgrade to firmware version 1.5.1.5 or higher and disable WAN-side web management access

[Affected Scope] BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) affected versions

[Impact] Unauthenticated remote attackers can inject and execute arbitrary system commands with the privileges of the 'site user'.

[Mitigation] Immediately apply the official security patches provided by BeyondTrust (BT24-10) and restrict access to management interfaces.

[Affected Scope] Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.24

[Impact] Unauthenticated remote attackers can leverage default settings of the Autorun directory to import and execute arbitrary Bash or PowerShell commands on the host system, leading to full system compromise.

[Mitigation] Immediately upgrade to the patched version (5.8.0.24 or higher) and restrict access to exposed management interfaces.

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures

[Affected Scope] All firmware versions of End-of-Life (EOL) D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L

[Impact] Unauthenticated remote attackers can leverage hardcoded credentials and inject arbitrary system commands to achieve full system compromise

[Mitigation] Since these products are no longer supported, it is strongly recommended to immediately retire and replace the affected devices

[Affected Scope] Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) gateway appliances

[Impact] An authenticated administrator can send specially crafted HTTP requests to execute arbitrary OS commands with root privileges, leading to full appliance compromise

[Mitigation] Apply the official vendor security patches immediately, or import the temporary mitigation XML file provided by Ivanti to block vulnerable API endpoints

[Affected Scope] VMware Aria Operations for Networks (formerly vRealize Network Insight) 6.x versions

[Impact] Unauthenticated remote attackers with network access can execute arbitrary commands with root privileges, leading to complete system compromise

[Mitigation] Apply the official VMware security patches (VMSA-2023-0012) immediately and restrict access to management interfaces

[Affected Scope] Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001 through 9.2.0.006

[Impact] A remote attacker can execute arbitrary system commands with the privileges of the ESG product by sending a specially crafted .tar archive, leading to complete system compromise

[Mitigation] Verify the automatic application of patch BNSF-36456, perform a thorough compromise assessment (IoC search), and immediately replace compromised appliances

[Affected Scope] Sophos Web Appliance versions prior to 4.3.10.4

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade Sophos Web Appliance to version 4.3.10.4 or higher, or migrate to a supported alternative solution due to the product's End-of-Life (EOL) status.

[Affected Scope] D-Link DSL-2750B devices running firmware versions prior to 1.05

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the 'cli' parameter in login.cgi

[Mitigation] Apply the official firmware patch (v1.05 or later) or immediately disable WAN-side access to the web management interface

[Affected Scope] Systems running Cisco HyperFlex HX Data Platform with the web-based management interface enabled

[Impact] Unauthenticated, remote attackers can execute arbitrary system commands with root privileges on the affected device by sending crafted HTTP requests

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict external access to the web management interface

[Affected Scope] QNAP QTS (prior to 4.5.2, 4.5.1, 4.3.6, 4.3.4, 4.3.3, 4.2.6) and QuTS hero (prior to h4.5.1)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges on the compromised NAS device

[Mitigation] Immediately upgrade QNAP firmware to the patched versions and restrict external internet access to the NAS management interface