Loading story…
STAR Labs disclosed two vulnerabilities in the Askey AP5100W Wi-Fi mesh node that can let attackers on the local network gain administrative access and retrieve sensitive configuration data. In CVE-2020-25546, the web management interface was found to use a flawed authentication design that appears to set a global authenticated state after any successful login, rather than creating a user-specific session. Because the interface reportedly uses no session keys or cookies, a second user on the network may be able to access administrative functions once a legitimate administrator has logged in.
In CVE-2020-25545, the same device was reported to expose configuration backups containing sensitive data, including the admin password and Wi-Fi password. An authenticated attacker can generate and download the backup archive, and STAR Labs said that if a backup file already exists, it may be possible to retrieve it without authentication in a worst-case scenario. The researchers tested the issues on firmware Dual_SIG_1.01.071 and said the product had been supplied to Singtel broadband customers, while repeated disclosure attempts to Askey, CSA, Singtel, and MITRE reportedly received limited or no vendor response.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of the advisories, STAR Labs publicly disclosed CVE-2020-25545, an information leak via insecure backups, and CVE-2020-25546, a logic flaw allowing web admin authentication bypass on the Askey AP5100W. The disclosures included technical details and noted the lack of vendor response.
According to the disclosure timelines in the advisories, STAR Labs made repeated attempts during 2020 to report the AP5100W vulnerabilities to Askey, Singapore's CSA, Singtel, and MITRE. The vendor reportedly did not respond, while other parties provided limited or delayed responses.
STAR Labs found that Askey AP5100W Wi-Fi mesh nodes running firmware version Dual_SIG_1.01.071 were affected by two issues: an authentication bypass caused by broken session handling and an insecure backup mechanism that exposed sensitive configuration data. The affected devices had been supplied to Singtel broadband customers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acer disclosed two **critical zero-day vulnerabilities** affecting **Wave 7 mesh routers** running firmware `T7c_GBL_1.01.000055` or earlier, both assigned a **CVSS score of 10.0**. The flaws, reported by researcher **Gergo Pap**, are tracked as `CVE-2026-49200` and `CVE-2026-49201`. The first allows unauthenticated attackers to access the internal `acer_cgi.log` file through the web interface and recover **plaintext administrative credentials** for the web and Telnet services. The second vulnerability stems from a **hardcoded AES key** in the `upload.cgi` backup-processing component, allowing attackers to decrypt, modify, and re-encrypt router backup files to implant **persistent backdoors**. Acer said emergency firmware updates were still in development and targeted for release by the end of June 2026. Until patches are available, the company urged customers to **disable remote management** or restrict Internet access to **trusted IP addresses only**, and to monitor the router management interface for firmware updates and apply them immediately once released.
Jun 29, 2026
TP-Link disclosed two vulnerabilities in **Archer AX55 V4** routers. High-severity `CVE-2026-18167` is a stack-based buffer overflow in EasyMesh that a local-network attacker can exploit, when Mesh mode is enabled, to crash the EasyMesh daemon and potentially execute code on the router. Medium-severity `CVE-2026-18330` affects the web-login module, which uses a hardcoded shared RSA-1024 private key and weak AES session-key handling. An attacker able to capture an HTTP administrator-login session on the local network could use `CVE-2026-18330` to decrypt the router administrator password. TP-Link remediated both flaws in firmware **1.2.1 Build 20260527** and advised affected users to update promptly, avoid HTTP-based administration, and disable Mesh mode if it is not required.
Sep 5, 2026
CERT/CC disclosed an unpatched authentication backdoor in firmware used by several older **Tenda** Wi-Fi routers, tracked as `CVE-2026-11405`, that can let attackers bypass normal web login and gain administrator access. The flaw lies in the router web interface's login logic, which reportedly falls back to a secondary authentication path after a failed login attempt and validates only a stored password value instead of both username and password. Researchers said the alternate password appears to be **`rzadmin`**, and because the username is not checked, an attacker may be able to log in with any username paired with the backdoor password. The affected issue spans five firmware versions across multiple Tenda models, and no official vendor patch was available at disclosure. Successful exploitation could allow attackers to change router settings, disable security protections, and potentially compromise connected local networks. Reporting on the disclosure also pointed to a broader pattern of security problems in Tenda devices, citing earlier hardcoded credential exposure, `CVE-2020-35391` in the Tenda N300 that exposed configuration data and administrative passwords, and `CVE-2026-36794`, a denial-of-service flaw in the Tenda W3. CERT/CC advised users to disable remote web management, change the default LAN IP address, and replace unsupported devices if updates are unavailable.
Jul 20, 2026