1935648903

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-825 versions 1.0.5 and 4.5.1 D-Link DIR-825R versions 1.0.5 and 4.5.1 **Description** A flaw exists in the NTP Service component of D-Link DIR-825 and DIR-825R. The issue is located within the `handler update system time` function of the `libdeuteron modules.so` file. Successful manipulation of this function can lead to operating system command injection. The attack can be initiated remotely. It is important to note that this issue only impacts products that are no longer receiving support from the maintainer. **Recommendations** D-Link DIR-825 version 1.0.5: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-825 version 4.5.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-825R version 1.0.5: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-825R version 4.5.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK X6000R versions 9.4.0cu.1360 B20241207 through 9.4.0cu.1498 B20250826 **Description** A flaw exists in the TOTOLINK X6000R router. A manipulation of the `Hostname` argument in the `setLanCfg` function within the `/usr/sbin/shttpd` file can lead to os command injection. This issue may be exploited remotely. **Recommendations** Update TOTOLINK X6000R to a version later than 9.4.0cu.1498 B20250826.

**Name of the Vulnerable Software and Affected Versions** Tenda AC8 version 16.03.34.06 **Description** A flaw exists in Tenda AC8 version 16.03.34.06 that allows for remote buffer overflow. The issue is located in an unknown function within the `/goform/DatabaseIniSet` file. The `Time` argument can be manipulated to trigger the overflow. The exploit for this issue has been publicly disclosed. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda A15 version 15.13.07.13 **Description** A buffer overflow issue exists in the `fromSetWirelessRepeat` function within the `/goform/openNetworkGateway` file of Tenda A15. The issue is triggered by manipulating the `wpapsk crypto2 4g` argument, allowing for remote exploitation. The exploit for this issue has been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC10 version 16.03.10.13 **Description** A flaw exists in the `formSysRunCmd` function within the `/goform/SysRunCmd` file. Manipulation of the `getui` argument can lead to a buffer overflow. This issue can be exploited remotely. The exploit for this issue has been publicly disclosed. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `/goform/SysRunCmd` file to minimize the risk of exploitation.