CVE-2026-35906

CVSS 9.6 CRITICALEPSS 0.5%CWE-78

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.6EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

04 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

n/a · n/a

References

https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35906.md https://t3techgroup.com https://www.ncsa.or.th https://www.true.th/