Loading story…
Multiple critical vulnerabilities have been discovered in Planet Technology's industrial cellular gateways. These flaws could expose critical infrastructure to remote attacks, including denial-of-service and unauthorized access. Immediate patching and mitigation are recommended for affected deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
cve.akaoma.com
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Advantech disclosed multiple vulnerabilities affecting its **WISE-6610** industrial gateway product line. The issues affect multiple models and software versions, although the available public notices do not specify CVE identifiers, severity scores, technical impacts, or evidence of exploitation. The Canadian Centre for Cyber Security issued advisory `AV26-907` covering the affected gateways and directed operators and administrators to Advantech’s security advisory for product-specific details. Organizations using WISE-6610 devices should identify exposed and deployed units, review Advantech guidance, and apply available updates through established industrial-control-system change-management processes.
Sep 10, 2026
TP-Link has released security updates to address four critical vulnerabilities affecting its Omada gateway devices, with two of these flaws enabling remote code execution. The most severe of these vulnerabilities, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote unauthenticated attackers to execute arbitrary commands on the device's underlying operating system. Another critical flaw, CVE-2025-6541, is an operating system command injection vulnerability that can be exploited by attackers with access to the web management interface. CVE-2025-7850, also with a CVSS score of 9.3, requires possession of an administrator password to exploit, but similarly allows arbitrary command execution. The fourth vulnerability, CVE-2025-7851, involves improper privilege management and could enable attackers to obtain a root shell under certain conditions. Affected models include ER8411, ER7412-M2, ER707-M2, ER7206, ER605, ER706W, ER706W-4G, ER7212PC, G36, G611, FR365, FR205, and FR307-M2, with specific firmware versions listed as vulnerable. TP-Link has advised all users of impacted devices to immediately update to the latest firmware versions to mitigate these risks. The company also recommends verifying device configurations after upgrading the firmware to ensure security settings remain intact. There is currently no evidence that these vulnerabilities have been exploited in the wild, but the critical nature of the flaws and the potential for remote, unauthenticated exploitation make prompt patching essential. The vulnerabilities could allow attackers to gain full control over affected devices, potentially enabling lateral movement within networks or use of the devices as a foothold for further attacks. The flaws were disclosed in a coordinated manner, and TP-Link responded by releasing patches and advisories to inform customers. Security researchers have highlighted the risk posed by these vulnerabilities, especially in environments where Omada gateways are used to manage network traffic and security. Organizations using these devices should prioritize patching and review their network segmentation to limit potential exposure. The vulnerabilities underscore the importance of regular firmware updates and strong administrative credential management for network infrastructure devices. TP-Link's advisory provides detailed instructions for identifying affected models and applying the necessary updates. The disclosure has prompted renewed attention to the security of network gateways and the need for ongoing vigilance in monitoring for new vulnerabilities. Security teams are urged to monitor for signs of compromise and to ensure that all network devices are included in vulnerability management programs. The incident serves as a reminder of the critical role that timely patching plays in defending against remote exploitation threats.
Jul 12, 2026
Several high-severity vulnerabilities were disclosed across IoT/OT infrastructure products, creating pathways to **unauthenticated remote code execution** or full device compromise. **Ruckus vRIoT IoT Controller** was reported to contain two **CVSS 10.0** issues—`CVE-2025-69425` and `CVE-2025-69426`—driven by **hardcoded secrets/credentials** that enable attackers to bypass authentication and obtain **root-level command execution**, including via a service listening on **TCP port 2004**. Separately, Singapore’s **CSA** issued a high-priority alert for **Advantech** software affected by a **CVSS 10.0 SQL injection** (`CVE-2025-52694`) that allows an **unauthenticated remote attacker** to execute arbitrary SQL commands against exposed services, impacting multiple *IoTSuite* and *IoT Edge* components and requiring upgrades (some obtained via vendor support channels).
Jun 29, 2026