NETGEAR RAX120 V1.2.5.18 SOAP InstallApp command injection disclosed
An authenticated request can reach OS command execution in the router's root-configured web stack.
44
Organization
0day Rubbish Research Team
- Mentions · 7d0
- Mentions · 30d18
- All mentions40
- First seenSep 8, 2026
- Last mentioned13d ago
Timeline
40 articles · newest firstRaritan PX3 PDU 4.3.14 diagnostics allow command injection
A low-privilege authenticated diagnostics request can run OS commands in the web-service context.
56
NUUO Crystal Server 3.19.0.85 allows unauthenticated PHP upload to RCE
Uploaded PHP can execute through FastCGI as the web service account, rated 9.8 Critical.
66
Moxa MAR-2000 firmware ping condition allows command injection
A saved monitoring field is reused by a scheduled ping thread for recurring command execution.
48
Moxa MAR-2000 IPsec route commands allow authenticated injection
Firmware FWR_MAR2000_V1.0_Build_15010909 interpolates a stored VPN address into shell commands run as the model process.
46
Moxa MAR-2000 Executer path allows authenticated command injection
A stored configuration field is built into the shell command that launches an operator program as the model process.
44
TRENDnet TV-IP302PI 1.02.38 NTP field injects root commands
An authenticated NTP server-address reaches a shell-form system() call; the disclosure rates it 7.2 High.
52
Royal Render 9.1.26b job port runs shells on workers
Default-unauthenticated submissions on rrServer TCP 7773 execute as the worker identity, measured as root.
58
ProSoft RLX-IFH24E v2.2.44 accepts unsigned firmware to root
An unsigned upgrade package can run root commands and overwrite the full account database; rated 7.2.
56
Parasoft CTP 10.7.5-SNAPSHOT anonymous deserialization leads to command execution
Researchers say an anonymous database-restore deserialization in the em web app can run commands as uid=1000.
58
Exasol Database 7.1.30 docker-db default SYS credential enables command execution
The docker-db image ships a default SYS credential that reaches os.popen through a PYTHON3 UDF.
52
Edimax BR-6478AC v2.20 setWAN handler has authenticated command injection
A WAN-settings POST passes an unsanitized username into system(), and the check looks at one character.
46
Edimax BR-6478AC v2.20 formWlanMP handler has authenticated command injection
A production manufacturing-test route still accepts thirty raw fields that are passed to system().
46
[0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H)
Maian Guardian 2.1 license generator has a command injection that runs code as www-data.
42
[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)
Dataedo Portal 26.2.8 can push a deserialized scheduler job that the Agent runs as host commands.
55
[0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)
CloudPanel 2.5.4-3 site settings can inject an nginx vhost and run code as root.
62
[0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8)
Unauthenticated zip-slip in Auerswald COMmander 6000 firmware 8.6D yields root code execution.
68
[0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5)
Researchers disclosed a command-execution chain in Aprelium Abyss Web Server X1 2.16.22.0 before console password setup.
46
[0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary)
Researchers disclose StreamSets Transformer 3.17.0 auth fail-open and unsandboxed code execution as container root.
64
[0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)
Disclosure: RCDevs WebADM 2.4.14 log viewer command injection yields code execution as uid 999.
54
[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)
Maian Cart 3.8 allows unrestricted banner uploads that become PHP webshells for administrator command execution.
46
[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)
IPConfigure Orchid VMS 26.3.0 allows authenticated command injection through a DNF GPG-key property to root.
48
[0day-rubbish] Circutor LineEds 24.11.14-r0 unauthenticated pwrstudio events.xml shellExecute command injection (9.8)
Circutor LineEds 24.11.14-r0 has unauthenticated command injection in pwrstudio via events.xml shellExecute.
64
[0day-rubbish] Asustor ADM 3.5.9.RWM1 (AS602T) music.cgi act=live stored-filename command injection reaching system() (8.8 primary, PR:L)
Researchers disclosed command injection in Asustor ADM 3.5.9 music.cgi on the AS602T, rated 8.8.
47
[0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8)
Unauthenticated file upload and path traversal in Advantech WebAccess Node 9.2.3 can execute code, scored 9.8.
63
[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)
0day Rubbish disclosed authenticated root command execution in Server Technology PRO3X PDUs on firmware 030600.
46
[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)
Logo Netsis NetOpenX REST 2.0.6.9 allows unauthenticated SQL injection that can run commands as SYSTEM.
73
[0day-rubbish] MultiTech Conduit AEP 6.3.6 Authenticated import_config filename command injection to root RCE (7.2)
MultiTech Conduit AEP 6.3.6 has an authenticated filename injection that can yield root on IoT gateways.
47
[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)
Researchers disclosed an unauthenticated JMX flaw in Lightstreamer Server 7.4.8 that can load native code in the JVM.
48
[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)
Lightstreamer Server 7.4.8 ships placeholder JMX credentials that enable remote class loading and root code execution.
62
[0day-rubbish] Lantronix SGX5150 9.13.0.0R7 Authenticated FsBrowseClean command injection to root RCE (7.2)
Lantronix SGX5150 firmware has an authenticated command-injection flaw that can yield root code execution.
42
[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)
FME Flow 2026.2 has a Zip-Slip flaw that can write arbitrary files and execute code as LocalSystem.
52
[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)
Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR field allows command injection to root RCE.
55
[0day-rubbish] Opengear NGCS 25.11.8 Authenticated PDU name command injection to root via io.popen (8.8)
Researchers disclosed an authenticated Opengear NGCS 25.11.8 command-injection bug that executes commands as root.
58
[0day-rubbish] LCDS Laquis SCADA Unauthenticated /uploade.html file write chained with CMDEXT*.DLL autoload (9.8)
Unauthenticated file upload in LCDS Laquis SCADA chains with DLL autoload for code execution, CVSS 9.8.
72
[0day-rubbish] Ecava IntegraXor IGX 16.0.701.10 Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (9.8)
Unauthenticated file upload in Ecava IntegraXor IGX 16.0.701.10 chains to cmd.exe for Administrator code execution.
78
[0day-rubbish] Devolutions Server (DVLS) 2026.2.14.0 PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (9.1)
Authenticated Devolutions Server admins can bypass PAM checks and run SYSTEM PowerShell via a test-script endpoint.
62
[0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)
Unauthenticated attackers can trigger CaptureBites MetaServer RunPrograms execution as SYSTEM through an anonymous WCF SOAP workflow.
66
[0day-rubbish] PrizmDoc for Java (VirtualViewer) 5.22.1 Unauthenticated uploadDocument write into the webapp root to JSP webshell (9.8)
Unauthenticated upload in PrizmDoc for Java 5.22.1 writes a JSP webshell into the webapp root as root.
72
[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)
0day Rubbish Research Team disclosed a CVSS 7.2 local privilege escalation (CWE-250) in Royal Server 5.04.50529.0 to LocalSystem.
45
Appears with
- MAR-2000product · 3
- Lightstreamervendor · 2
- Moxa Inc.vendor · 2
- JMS Extenderproduct · 2
- BR-6478ACproduct · 2
- Edimax Technologyvendor · 2
- Lightstreamer Serverproduct · 2
- CaptureBitesvendor · 1
- CloudPanelproduct · 1
- Accusoftvendor · 1
- Opengearvendor · 1
- Asustorvendor · 1
- Auerswaldorganization · 1
- TRENDnetvendor · 1
- Circutorvendor · 1
- Auerswaldvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.