CVE Watch5 jul 2026

CVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentia

CVSS

8.8

Alto

EPSS

0.6%

p44

KEV

—

Exploit Today

0-100

Publicado: 28 jul 2025 · Última mod.: 5 jul 2026 · CWE-78

EPSS · 30d

0.6%EPSS · 30 días0.7%

2026-06-302026-07-17

Descripción técnica

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call.

Referencias oficiales

gist.github.comhttps://gist.github.com/EmptyButter/19b2c626f4589d1f9d4478632205a9eb

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2024-121210.0 CRÍ

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability4d CVE-2026-398089.8 CRÍ

99.7%

KEV—80Fortinet FortiSandbox OS Command Injection Vulnerability22h CVE-2022-262589.8 CRÍ

99.6%

KEV—80D-Link DIR-820L Remote Code Execution Vulnerability9d CVE-2026-422718.8 ALT

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability3d CVE-2021-252988.8 ALT

99.5%

KEV—80Nagios XI OS Command Injection9d