CVE-2026-35906

CVSS 9.6 CRITICALEPSS 0.5%CWE-78

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.6EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

04 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Productos afectados

n/a · n/a

Referencias

https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35906.md https://t3techgroup.com https://www.ncsa.or.th https://www.true.th/