Category: Vulnerabilities & Advisories

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in NETGEAR
RAX120 (Nighthawk AX12) firmware V1.2.5.18, the WiFi 6 consumer router from
NETGEAR (United States), built on the Qualcomm IPQ8074 platform. The
administrative web plane of this firmware generation is a lighttpd server
fronting the vendor’s DNI-framework CGI handler /usr/sbin/net-cgi (an
aarch64, musl, stripped image; the handler binary measures 1,042,120 bytes
and…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the
Raritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power
distribution unit from Raritan, a Legrand company (United States). A
low-privilege authenticated session converts one diagnostics request into
operating-system command execution in the product’s web-service context,
because the hostname validation that is supposed to gate the ping and
traceroute…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in NUUO
Crystal Server 3.19.0.85, the video management and NVR server software from
NUUO Inc. of Taipei (Taiwan), distributed as the Crystal virtual-machine
appliance: an Ubuntu-based OVA whose web tier is a lighttpd server fronting
a PHP application, with .php requests dispatched to /usr/bin/php-cgi through
lighttpd’s fastcgi mapping. The product sits in the management plane…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa
MAR-2000 series industrial 4G/LTE cellular router, firmware image
FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated
administrator converts one saved monitoring-condition field into recurring,
product-scheduled arbitrary command execution, because the thread that
implements the scenario ping condition builds its command line from the…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa
MAR-2000 series industrial 4G/LTE cellular router, firmware image
FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated
administrator converts one stored VPN address field into arbitrary command
execution as the identity of the product’s model process, because the IPsec
model manages the tunnel’s addresses and routes by interpolating…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by disclosure via Fulldisclosure on Oct 28

0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa
MAR-2000 series industrial 4G/LTE cellular router, firmware image
FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated
administrator converts one stored configuration field into arbitrary command
execution as the identity of the product’s model process, because the
Executer model builds the launch command of an operator program as a shell…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by fulldisclosure on Oct 28

Am 21.10.26 um 07:23 schrieb jose:

that is the CVE for the OOM RCE vulnerability in fpm and mod_php. Sure
you got the right on?

Best regards,
Marius

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by Daniel Owens via Fulldisclosure on Oct 28

On 29 August 2026, we released “Commas of D00m” — an old proof of concept that demonstrates unconstrained resource
consumption in many JSON parsers. As recently discussed (in “Continued Apache Struts2 JSON Plugin Insecure
Deserialisation”), the Apache Struts2 JSON Plugin’s S2-072 and prior code changes fail to sufficiently protect against
this style of attack. In that write-up, we examined the code and the…

Source: Full Disclosure (seclists.org) · 2026-10-29

Posted by Daniel Owens via Fulldisclosure on Oct 28

Summary
Thus far we have written extensively about the rampant number of insecure JavaScript Object Notation (JSON)
deserialisers available today, like in “Struts2 and Related Framework Array/Collection DoS” (26 October 2025) and “JSON
Deserialiser Unconstrained Resource Consumption Quick Overview” (07 March 2026), along with a naïve proof of concept
script that demonstrated what we were talking about — “JSON…

Source: Full Disclosure (seclists.org) · 2026-10-29