Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
More on Unauthenticated
Other advisories
- MediumCVE-2026-129447Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascr…
- Not ratedCVE-2026-119258The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated att…
- Not ratedCVE-2026-117487The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not r…
- CriticalCVE-2026-124020Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the…
- MediumCVE-2026-128886A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial …
- MediumCVE-2026-9870IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScrip…
- CriticalCVE-2026-82504VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attacker…
- HighCVE-2026-127216Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger passwo…
Other news entries
- Hackers Exploit New N-central Zero-Day Hours After PoC PublicationNewsSecurityWeek
- Apache HTTP Server patches critical HTTP/2 remote code execution flawNewsBleepingComputer
- Cisco BroadWorks Out-of-Band Blind XML External Entity Injection VulnerabilityNewsCisco PSIRT
- Apache Patches Critical HTTP Server RCE Found by Anthropic, GoogleNewsSecurityWeek
- Hackers Target N-central Zero-Days as N-able Rushes PatchesNewsSecurityWeek
- Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on FailoverNewsThe Hacker News
- Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' DataNewsThe Hacker News
- Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code RemotelyNewsThe Hacker News
Source: https://thehackernews.com/2026/08/chinese-made-zbtlink-routers-ship-with.html
ID