Loading story…
An exploit published in Exploit Database details an unauthenticated remote code execution flaw in Netlink GPON Router firmware 1.0.11. The issue affects the /boaform/admin/formPing endpoint, where the target_addr parameter can be manipulated to inject shell commands into the device operating system.
The proof of concept shows an attacker appending shell metacharacters to a crafted request and receiving a directory listing in the HTTP response, demonstrating successful command execution on the router. The exploit was credited to shellord and was published without an assigned CVE identifier, leaving defenders to track the issue through exploit intelligence rather than a formal vulnerability record.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
An Exploit Database entry documented a remote code execution vulnerability in Netlink GPON Router version 1.0.11, showing command injection via the /boaform/admin/formPing endpoint. The entry states no CVE identifier was assigned and includes a proof of concept that executes shell commands through the target_addr parameter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two unauthenticated command injection flaws in the Prolink `PRC2402M` router that allow remote attackers to execute arbitrary commands as `root` via the `/cgi-bin/mesh.cgi` endpoint. The vulnerabilities, tracked as `CVE-2021-35400` and `CVE-2021-35407`, were verified on firmware version `20190909` and stem from user-controlled input in the `key` parameter being passed to `popen` without proper validation. One issue is reachable when `page=extender` triggers `get_extender_page`, while the other is exposed when `page=upgrade` invokes `get_upgrade_page`. In both cases, the vulnerable code builds shell commands using router values such as `lan_ipaddr` together with attacker-supplied input, enabling crafted HTTP `GET` requests to inject shell syntax and run commands on the device. Prolink was notified of the bugs on June 10, initially said a patch was available the same day, then received a bypass report on June 11 before issuing a final fix on June 13. The disclosures indicate that internet-exposed devices running the affected firmware could be compromised without authentication through the router's web interface.
Jun 29, 2026
STAR Labs disclosed two authenticated command injection vulnerabilities in the Prolink `PRC2402M` router that allow arbitrary command execution as `root` on firmware version `20190909`. Tracked as `CVE-2021-35404` and `CVE-2021-35406`, the flaws affect the router's `applogin.cgi` and `login.cgi` handlers, where the `sys_login1` function passes user-controlled input to the system shell without proper validation after a password hash check. In one case, the vulnerable path is triggered with `api=app`; in both cases, the `ipaddr` parameter is central to exploitation, and `lang` is also injectable in the `applogin.cgi` flow. The disclosures say an authenticated attacker can send crafted POST requests to `/cgi-bin/applogin.cgi` or `/cgi-bin/login.cgi` and execute arbitrary commands with full device privileges. STAR Labs reported the issues to Prolink, which initially said a patch was available, but a bypass was then identified and submitted by researcher Daniel Lim before the vendor issued a final fix. The advisories also note that the router's `lighttpd` service processes the requests and that exploit payloads must use CRLF line endings to be accepted in the demonstrated attack path.
Jun 29, 2026
Two high-severity command injection vulnerabilities have been disclosed in the **Totolink A3300R** router, both affecting firmware version `17.0.0cu.557_b20221024` and exposing the device to remote code execution through `/cgi-bin/cstecgi.cgi`. The flaws are tracked as **`CVE-2026-5104`** and **`CVE-2026-5101`**. `CVE-2026-5104` affects the `setStaticRoute` function, where manipulation of the `ip` argument can trigger command injection, while `CVE-2026-5101` affects the `setLanCfg` function in the Parameter Handler component through the `lanIp` argument. Public exploit material has been disclosed for both issues, according to VulDB and referenced advisory material, raising the risk of active abuse against exposed devices. NVD subsequently added initial analysis for the CVEs, assigning higher **CVSS v3.1** severity assessments than the original CNA submissions and mapping the weaknesses to **`CWE-77`**, **`CWE-74`**, and **`CWE-78`**. The disclosures indicate that attackers could remotely inject operating system commands via crafted requests, making patching, exposure reduction, and monitoring of internet-facing Totolink A3300R systems urgent priorities.
Jun 29, 2026