https://poc.intelseclab.com/pocs/network/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Critical severity (CVSS 10) — network · CVE-2026-34910, CVE-2026-34909, CVE-2026-34908. Status: Patched. Affects: Ubiquiti UniFi OS Server. Tags: ubiquiti, unifi, unifi-os, auth-bypass, path-traversal, command-injection, rce, unauth, kev, mirai, nginx, CVE-2026-34910.networkCriticalubiquitiunifiunifi-osauth-bypasspath-traversalcommand-injectionrceunauthkevmirainginxCVE-2026-34910https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-8452-citrix-netscaler-saml-preauth-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-8452-citrix-netscaler-saml-preauth-rce/Critical severity (CVSS 9.8) — network · CVE-2026-8452. Status: Patched. Affects: Citrix NetScaler ADC and NetScaler Gateway. Tags: citrix, netscaler, adc, gateway, saml, heap-overflow, preauth, rce, shellcode, webshell, freebsd, xml-signature, c14n, CVE-2026-8452.networkCriticalcitrixnetscaleradcgatewaysamlheap-overflowpreauthrceshellcodewebshellfreebsdxml-signaturec14nCVE-2026-8452https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-20200-cisco-imc-argument-injection-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-20200-cisco-imc-argument-injection-rce/Critical severity (CVSS 9.9) — network · CVE-2026-20200 / NSIDE-SA-2026-003. Status: Patched. Affects: Cisco Integrated Management Controller (CIMC). Tags: cisco, imc, cimc, argument-injection, rce, redfish, curl, reverse-shell, arm, file-read, file-write, CVE-2026-20200.networkCriticalciscoimccimcargument-injectionrceredfishcurlreverse-shellarmfile-readfile-writeCVE-2026-20200https://poc.intelseclab.com/pocs/network/2026-08-15_cve-2026-47301-sccm-adminservice-cab-rce/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-15_cve-2026-47301-sccm-adminservice-cab-rce/Critical severity (CVSS 9.8) — network · CVE-2026-47301. Status: Patched. Affects: Microsoft Configuration Manager (SCCM / ConfigMgr), AdminService REST API. Tags: windows, sccm, configmgr, rce, cab, path-traversal, dll-hijacking, dll-proxy, arbitrary-file-write, system, microsoft, CVE-2026-47301.networkCriticalwindowssccmconfigmgrrcecabpath-traversaldll-hijackingdll-proxyarbitrary-file-writesystemmicrosoftCVE-2026-47301https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/High severity (CVSS 8) — network · CVE-2026-27912. Status: Patched. Affects: Microsoft Windows Kerberos Key Distribution Center (KDC), Change Password protocol (kadmin/changepw). Tags: windows, kerberos, active-directory, privilege-escalation, password-reset, domain-controller, upn, rubeus, changepw, krbtgt, CWE-285, microsoft, CVE-2026-27912.networkHighwindowskerberosactive-directoryprivilege-escalationpassword-resetdomain-controllerupnrubeuschangepwkrbtgtCWE-285microsoftCVE-2026-27912https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/High severity (CVSS 8.8) — network · CVE-2026-25177. Status: Patched. Affects: Microsoft Active Directory Domain Services, Service Principal Name (SPN) validation. Tags: windows, active-directory, kerberos, spn, unicode, homoglyph, privilege-escalation, detection, scanner, ldap, CWE-641, microsoft, CVE-2026-25177.networkHighwindowsactive-directorykerberosspnunicodehomoglyphprivilege-escalationdetectionscannerldapCWE-641microsoftCVE-2026-25177https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2023-35078-ivanti-epmm-unauth-api-access/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2023-35078-ivanti-epmm-unauth-api-access/Critical severity (CVSS 9.8) — network · CVE-2023-35078 (Ivanti advisory; CWE-287 per NVD). Status: Patched (Ivanti EPMM 11.8.1.1, 11.9.1.1, 11.10.0.2 and later). Affects: Ivanti Endpoint Manager Mobile (EPMM), previously branded MobileIron Core — the /mifs/aad/api/ administrative API surface. Tags: ivanti, epmm, mobileiron-core, mdm, authentication-bypass, cwe-287, unauthenticated, api, pii-disclosure, cisa-kev, ransomware, scanner.networkCriticalivantiepmmmobileiron-coremdmauthentication-bypasscwe-287unauthenticatedapipii-disclosurecisa-kevransomwarescannerhttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2025-22457-ivanti-connect-secure-stack-overflow/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2025-22457-ivanti-connect-secure-stack-overflow/Critical severity (CVSS 9) — network · CVE-2025-22457. Status: Patched. Affects: Ivanti Connect Secure, Pulse Connect Secure (end of support), Ivanti Policy Secure, Ivanti ZTA Gateways — the /home/bin/web HTTPS front-end process. Tags: ivanti, connect-secure, pulse-connect-secure, policy-secure, zta-gateway, vpn, stack-overflow, CWE-121, buffer-overflow, rce, unauthenticated, rop, heap-spray, aslr-bruteforce, x-forwarded-for, cisa-kev, ransomware, ruby, edge-device.networkCriticalivanticonnect-securepulse-connect-securepolicy-securezta-gatewayvpnstack-overflowCWE-121buffer-overflowrceunauthenticatedropheap-sprayaslr-bruteforcex-forwarded-forcisa-kevransomwarerubyedge-devicehttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2026-16232-checkpoint-smartconsole-auth-bypass/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2026-16232-checkpoint-smartconsole-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-16232. Status: Patched. Affects: Check Point Security Management Server and Multi-Domain Security Management Server (MDS) — the legacy FWM/CPMI SIC service on TCP 18190 and the CPM SOAP web services on TCP 19009. Tags: check-point, smartconsole, security-management-server, multi-domain-server, cpmi, sic, fwm, authentication-bypass, CWE-287, improper-authentication, privilege-escalation, sso-token-forgery, soap, dle, cisa-kev, bod-26-04, python, firewall-management.networkCriticalcheck-pointsmartconsolesecurity-management-servermulti-domain-servercpmisicfwmauthentication-bypassCWE-287improper-authenticationprivilege-escalationsso-token-forgerysoapdlecisa-kevbod-26-04pythonfirewall-managementhttps://poc.intelseclab.com/pocs/network/2026-07-31_cve-2022-40684-fortios-auth-bypass-scanner/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-31_cve-2022-40684-fortios-auth-bypass-scanner/Critical severity (CVSS 9.8) — network · CVE-2022-40684. Status: Patched (FortiOS ≥7.2.2, ≥7.0.7; FortiProxy ≥7.2.1, ≥7.0.7; FortiSwitchManager ≥7.2.1). Affects: Fortinet FortiOS (FortiGate firewalls), FortiProxy web proxy, FortiSwitchManager web management interface / administrative REST API. Tags: fortios, fortiproxy, fortiswitchmanager, authentication-bypass, rest-api, header-injection, loopback-spoofing, fortigate, ssl-vpn, scanner.networkCriticalfortiosfortiproxyfortiswitchmanagerauthentication-bypassrest-apiheader-injectionloopback-spoofingfortigatessl-vpnscannerhttps://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54992-windows-msmq-heap-overflow/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54992-windows-msmq-heap-overflow/High severity (CVSS 8.4) — network · CVE-2026-54992. Status: PoC (crash/DoS confirmed, no RCE demonstrated). Affects: Windows Message Queuing (MSMQ) — Queue Manager (mqqm.dll, hosted in mqsvc.exe), reached via the MS-MQRR (RemoteRead) RPC interface. Tags: windows, msmq, message-queuing, heap-overflow, integer-overflow, rpc, dos, crash.networkHighwindowsmsmqmessage-queuingheap-overflowinteger-overflowrpcdoscrashhttps://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/High severity (CVSS 8.8) — network · CVE-2026-54121. Status: Weaponized. Affects: Microsoft Active Directory Certificate Services (AD CS) Enterprise CA, in environments where AD FS / certificate enrollment resolves DC identity via "chase" (cdc/rmd) request attributes. Tags: active-directory, adcs, certificate-services, dcsync, pkinit, kerberos, privilege-escalation, domain-controller-impersonation, windows.networkHighactive-directoryadcscertificate-servicesdcsyncpkinitkerberosprivilege-escalationdomain-controller-impersonationwindowshttps://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Critical severity (CVSS 8.6) — network · CVE-2026-20230 (cisco-sa-cucm-ssrf-cXPnHcW). Status: PoC — scanner/tester confirms the WebDialer precondition and SSRF reachability. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) — WebDialer service. Tags: cisco, unified-communications-manager, ucm, webdialer, ssrf, cwe-918, unauthenticated, remote, privilege-escalation, kev, actively-exploited.networkCriticalciscounified-communications-managerucmwebdialerssrfcwe-918unauthenticatedremoteprivilege-escalationkevactively-exploitedhttps://poc.intelseclab.com/pocs/network/2026-07-15_cve-2026-15409-sonicwall-sma1000-ssrf-erlang-rce/Wed, 15 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-15_cve-2026-15409-sonicwall-sma1000-ssrf-erlang-rce/Critical severity (CVSS 10) — network · CVE-2026-15409 (SNWLID-2026-0008). Status: Weaponized — unauthenticated, non-root remote code execution confirmed against a real appliance build. Affects: SonicWall SMA1000 Appliance — WorkPlace interface (websocket proxy service). Tags: sonicwall, sma1000, workplace, ssrf, erlang, rpc, cwe-918, unauthenticated, remote, kev, actively-exploited.networkCriticalsonicwallsma1000workplacessrferlangrpccwe-918unauthenticatedremotekevactively-exploitedhttps://poc.intelseclab.com/pocs/network/2026-07-12_openssh-agent-lock-provider-bypass/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-12_openssh-agent-lock-provider-bypass/High severity — network. Status: PoC — reproducible against a signed, checksum/signature-verified stock OpenSSH 10.4p1 build; no weaponized payload beyond starting an allowed PKCS#11 provider. Affects: OpenSSH portable — ssh, sshd, ssh-agent. Tags: openssh, ssh-agent, agent-forwarding, pkcs11, race-condition, state-confusion, no-cve, local-provider-abuse.networkHighopensshssh-agentagent-forwardingpkcs11race-conditionstate-confusionno-cvelocal-provider-abusehttps://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Critical severity (CVSS 9.8) — network · CVE-2022-26258. Status: Weaponized (public PoC available; listed in CISA KEV). Affects: D-Link DIR-820L wireless router, all hardware revisions. Tags: d-link, dir-820l, router, command-injection, cwe-78, unauthenticated, remote, iot, eol-device, kev.networkCriticald-linkdir-820lroutercommand-injectioncwe-78unauthenticatedremoteioteol-devicekevhttps://poc.intelseclab.com/pocs/network/2026-07-08_xring-xquic-qpack-ring-mem-resize-underflow/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-08_xring-xquic-qpack-ring-mem-resize-underflow/Critical severity — network. Status: Weaponized (public PoC, unpatched at publication). Affects: [alibaba/xquic](https://github.com/alibaba/xquic) — QUIC/HTTP-3 library, used by Tengine and reportedly across Alibaba's cloud/CDN infrastructure (Taobao, AliPay). Tags: quic, http3, qpack, xquic, alibaba, tengine, ring-buffer, integer-underflow, heap-oob-read, memcpy, remote, unauthenticated, dos, no-cve.networkCriticalquichttp3qpackxquicalibabatenginering-bufferinteger-underflowheap-oob-readmemcpyremoteunauthenticateddosno-cvehttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-54322-xspeeder-sxzos-preauth-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-54322-xspeeder-sxzos-preauth-rce/Critical severity (CVSS 10) — network · CVE-2025-54322. Status: Weaponized. Affects: XSpeeder SXZOS firmware (SD-WAN devices, routers, edge networking equipment). Tags: xspeeder, sxzos, sd-wan, router, firmware, python, django, eval-injection, pre-auth, rce, cwe-95.networkCriticalxspeedersxzossd-wanrouterfirmwarepythondjangoeval-injectionpre-authrcecwe-95https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-13315-twonky-server-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-13315-twonky-server-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-13315. Status: PoC. Affects: Twonky Server (Lynx Technology), a DLNA/UPnP media server. Tags: twonky-server, dlna, upnp, media-server, auth-bypass, access-control, information-disclosure, credential-leak, cwe-284, unauthenticated, nuclei.networkCriticaltwonky-serverdlnaupnpmedia-serverauth-bypassaccess-controlinformation-disclosurecredential-leakcwe-284unauthenticatednucleihttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Critical severity (CVSS 9.8) — network · CVE-2025-29384. Status: PoC. Affects: Tenda AC9 dual-band wireless router, web management interface (/goform/AdvSetMacMtuWan endpoint). Tags: tenda, ac9, router, stack-buffer-overflow, cwe-121, dos, rce, mips, embedded, iot, python, ruby, metasploit.networkCriticaltendaac9routerstack-buffer-overflowcwe-121dosrcemipsembeddediotpythonrubymetasploithttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-62168-squid-error-page-header-reflection-token-leak/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-62168-squid-error-page-header-reflection-token-leak/Critical severity (CVSS 10) — network · CVE-2025-62168. Status: PoC. Affects: Squid Proxy. Tags: squid, proxy, information-disclosure, header-reflection, jwt, token-leak, error-page, cwe-209, cwe-550.networkCriticalsquidproxyinformation-disclosureheader-reflectionjwttoken-leakerror-pagecwe-209cwe-550https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-11953. Status: Weaponized. Affects: @react-native-community/cli / @react-native-community/cli-server-api (Metro Development Server, openURLMiddleware). Tags: react-native, metro, dev-server, cli-server-api, open-url, command-injection, cwe-78, unauthenticated, node.js, python, windows, cross-platform.networkCriticalreact-nativemetrodev-servercli-server-apiopen-urlcommand-injectioncwe-78unauthenticatednode.jspythonwindowscross-platformhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Critical severity (CVSS 9.8) — network · CVE-2025-34299. Status: Weaponized. Affects: Monsta FTP (web-based FTP manager). Tags: monsta-ftp, rce, pre-auth, unrestricted-file-upload, cwe-434, php, ftp, docker, nuclei, kev.networkCriticalmonsta-ftprcepre-authunrestricted-file-uploadcwe-434phpftpdockernucleikevhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-52913-mitel-micollab-path-traversal/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-52913-mitel-micollab-path-traversal/Critical severity (CVSS 9.8) — network · CVE-2025-52913. Status: PoC. Affects: Mitel MiCollab (unified communications appliance). Tags: mitel, micollab, path-traversal, path-normalization, access-control-bypass, authentication-bypass, cwe-22, axis2, python, unified-communications.networkCriticalmitelmicollabpath-traversalpath-normalizationaccess-control-bypassauthentication-bypasscwe-22axis2pythonunified-communicationshttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-37164-hpe-oneview-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-37164-hpe-oneview-command-injection/Critical severity (CVSS 10) — network · CVE-2025-37164. Status: PoC. Affects: HPE OneView (infrastructure management appliance) REST API. Tags: hpe-oneview, command-injection, os-command-execution, rce, rest-api, python, cwe-78.networkCriticalhpe-oneviewcommand-injectionos-command-executionrcerest-apipythoncwe-78https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-66039-freepbx-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-66039-freepbx-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-66039. Status: PoC. Affects: FreePBX (Sangoma) framework module — web-based administration panel for Asterisk-based VoIP/PBX systems. Tags: freepbx, sangoma, voip, telephony, authentication-bypass, access-control, authtype, webserver-auth, cwe-287, cwe-863, nuclei, version-fingerprinting.networkCriticalfreepbxsangomavoiptelephonyauthentication-bypassaccess-controlauthtypewebserver-authcwe-287cwe-863nucleiversion-fingerprintinghttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-64446-fortiweb-cgiinfo-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-64446-fortiweb-cgiinfo-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-64446. Status: PoC. Affects: Fortinet FortiWeb (Web Application Firewall appliance). Tags: fortiweb, fortinet, waf, authentication-bypass, path-traversal, cgiinfo, cwe-22, cwe-288, admin-account-creation, python.networkCriticalfortiwebfortinetwafauthentication-bypasspath-traversalcgiinfocwe-22cwe-288admin-account-creationpythonhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-59718-fortios-version-detection-scanner/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-59718-fortios-version-detection-scanner/Critical severity (CVSS 9.8) — network · CVE-2025-59718 (Fortinet advisory FG-IR-25-647; related: CVE-2025-59719). Status: PoC. Affects: Fortinet FortiOS, FortiProxy, FortiSwitchManager, FortiWeb. Tags: fortinet, fortios, fortiproxy, fortiswitchmanager, fortiweb, forticloud-sso, authentication-bypass, version-detection, ssh, scanner, cwe-347.networkCriticalfortinetfortiosfortiproxyfortiswitchmanagerfortiwebforticloud-ssoauthentication-bypassversion-detectionsshscannercwe-347https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-63353-fiberhome-predictable-wifi-psk/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-63353-fiberhome-predictable-wifi-psk/Critical severity (CVSS 9.8) — network · CVE-2025-63353 / GHSA-cg2x-c25f-6327. Status: PoC. Affects: FiberHome HG6145F1 GPON ONT (Wuhan FiberHome International Technologies). Tags: fiberhome, hg6145f1, gpon-ont, predictable-psk, default-credentials, wpa2, wifi, cwe-284, cwe-1392.networkCriticalfiberhomehg6145f1gpon-ontpredictable-pskdefault-credentialswpa2wificwe-284cwe-1392https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-60854. Status: Weaponized. Affects: D-Link AX1500 router firmware (HNAP/DHMAPI web management SOAP interface). Tags: d-link, ax1500, router, command-injection, os-command-injection, hnap, soap, telnetd, cwe-78, iot.networkCriticald-linkax1500routercommand-injectionos-command-injectionhnapsoaptelnetdcwe-78iothttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11492-connectwise-automate-aitm-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11492-connectwise-automate-aitm-rce/Critical severity (CVSS 9.6) — network · CVE-2025-11492. Status: Weaponized. Affects: ConnectWise Automate (LabTech) RMM Agent. Tags: connectwise-automate, labtech, rmm, aitm, mitm, plugin-hijack, unencrypted-http, des3, privilege-escalation, python, csharp, dnspy, dotnet.networkCriticalconnectwise-automatelabtechrmmaitmmitmplugin-hijackunencrypted-httpdes3privilege-escalationpythoncsharpdnspydotnethttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-20393-cisco-asyncos-quarantine-rce-scanner/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-20393-cisco-asyncos-quarantine-rce-scanner/Critical severity (CVSS 10) — network · CVE-2025-20393. Status: PoC. Affects: Cisco AsyncOS for Secure Email Gateway (ESA) / Security Management Appliance (SMA). Tags: cisco, asyncos, secure-email-gateway, sma, spam-quarantine, tcp-6025, unauthenticated-rce, exposure-scanner, ioc-detection, backdoor-detection, python.networkCriticalciscoasyncossecure-email-gatewaysmaspam-quarantinetcp-6025unauthenticated-rceexposure-scannerioc-detectionbackdoor-detectionpythonhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-20333-cisco-asa-ftd-webvpn-buffer-overflow/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-20333-cisco-asa-ftd-webvpn-buffer-overflow/Critical severity (CVSS 9.9) — network · CVE-2025-20333. Status: PoC. Affects: Cisco Secure ASA and Cisco Secure FTD (WebVPN / AnyConnect file upload handler). Tags: cisco, asa, ftd, webvpn, anyconnect, heap-buffer-overflow, cwe-120, rce-as-root, exposure-scanner, path-traversal, python.networkCriticalciscoasaftdwebvpnanyconnectheap-buffer-overflowcwe-120rce-as-rootexposure-scannerpath-traversalpythonhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-55315-kestrel-http-request-smuggling/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-55315-kestrel-http-request-smuggling/Critical severity (CVSS 9.9) — network · CVE-2025-55315. Status: Weaponized. Affects: ASP.NET Core Kestrel web server (Microsoft.AspNetCore.Server.Kestrel). Tags: aspnet-core, kestrel, http-request-smuggling, chunked-transfer-encoding, dotnet, python, cwe-444, ssrf, cache-poisoning, webshell-upload.networkCriticalaspnet-corekestrelhttp-request-smugglingchunked-transfer-encodingdotnetpythoncwe-444ssrfcache-poisoningwebshell-uploadhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/High severity — network · CVE-2026-1459. Status: PoC. Affects: Zyxel VMG3625-T50B (and similar) router firmware. Tags: zyxel, router, firmware, command-injection, cgi-bin, ssh, authenticated, iot.networkHighzyxelrouterfirmwarecommand-injectioncgi-binsshauthenticatediothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34474-zte-router-sensitive-data-exposure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34474-zte-router-sensitive-data-exposure/High severity — network · CVE-2026-34474. Status: PoC. Affects: ZTE ZXHN H298A (hardware 1.1) and ZXHN H108N (hardware 2.6) home routers. Tags: information-disclosure, router, firmware, unauthenticated, credential-leak, iot, zte, wifi.networkHighinformation-disclosurerouterfirmwareunauthenticatedcredential-leakiotztewifihttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34472-zte-h188a-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34472-zte-h188a-auth-bypass/Critical severity — network · CVE-2026-34472. Status: PoC. Affects: ZTE ZXHN H188A V6 home router firmware. Tags: router, firmware, unauthenticated, auth-bypass, credential-leak, iot, zte, wifi.networkCriticalrouterfirmwareunauthenticatedauth-bypasscredential-leakiotztewifihttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34473-zte-router-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34473-zte-router-dos/High severity — network · CVE-2026-34473. Status: PoC. Affects: ZTE H-series routers (17+ models, reported as affecting 140K+ devices). Tags: router, firmware, unauthenticated, denial-of-service, iot, zte, cgilua, web-interface.networkHighrouterfirmwareunauthenticateddenial-of-serviceiotztecgiluaweb-interfacehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25807-zai-shell-p2p-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25807-zai-shell-p2p-rce/Critical severity — network · CVE-2026-25807. Status: PoC. Affects: ZAI-Shell (P2P terminal-sharing tool). Tags: zai-shell, p2p, rce, unauthenticated, terminal-sharing, socket, no-ai-mode, remote-command-execution.networkCriticalzai-shellp2prceunauthenticatedterminal-sharingsocketno-ai-moderemote-command-executionhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42568-yamcs-ldap-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42568-yamcs-ldap-injection/Medium severity — network · CVE-2026-42568 / GHSA-cqh3-jg8p-336j. Status: PoC. Affects: YAMCS (org.yamcs.security.LdapAuthModule). Tags: ldap-injection, authentication-bypass, yamcs, ldap, python, cwe-90.networkMediumldap-injectionauthentication-bypassyamcsldappythoncwe-90https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38698-wyze-cam-tutk-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38698-wyze-cam-tutk-heap-overflow/Critical severity — network · CVE-2026-38698. Status: PoC. Affects: TUTK SDK (as used in Wyze Cam Pan v3 and other TUTK-based IoT cameras). Tags: tutk-sdk, iot, camera, heap-overflow, av-server, wyze, authenticated, p2p.networkCriticaltutk-sdkiotcameraheap-overflowav-serverwyzeauthenticatedp2phttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-24294-petitpotam-smb-ntlm-reflection-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-24294-petitpotam-smb-ntlm-reflection-lpe/Critical severity — network · CVE-2026-24294 (Microsoft Security Response Center). Status: Weaponized. Affects: Windows Server 2025 (SMB client "arbitrary TCP port" feature). Tags: ntlm-relay, smb, petitpotam, windows-server-2025, local-privilege-escalation, lsass, coercion, impacket.networkCriticalntlm-relaysmbpetitpotamwindows-server-2025local-privilege-escalationlsasscoercionimpackethttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-26128-adcs-kerberos-relay-unicode-spn/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-26128-adcs-kerberos-relay-unicode-spn/Critical severity — network · CVE-2026-26128. Status: Weaponized. Affects: Windows Active Directory (DnsCache SPN resolution / Kerberos authentication). Tags: kerberos-relay, active-directory, adcs, unicode-normalization, spn-spoofing, ntlm-relay, dns-spoofing, privilege-escalation.networkCriticalkerberos-relayactive-directoryadcsunicode-normalizationspn-spoofingntlm-relaydns-spoofingprivilege-escalationhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33824-ikev2-ikeext-double-free-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33824-ikev2-ikeext-double-free-rce/Critical severity — network · CVE-2026-33824. Status: Weaponized. Affects: Windows IKEv2 IPsec driver (ikeext.dll). Tags: ikev2, windows-kernel, double-free, ikeext, rop-chain, heap-grooming, reverse-shell, anti-debug, packet-fragmentation.networkCriticalikev2windows-kerneldouble-freeikeextrop-chainheap-groomingreverse-shellanti-debugpacket-fragmentationhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36522-ardupilot-mavlink-nan-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36522-ardupilot-mavlink-nan-injection/Critical severity (CVSS 9.1) — network · CVE-2026-36522. Status: Weaponized. Affects: ArduPilot ArduPlane. Tags: ardupilot, mavlink, drone, nan-injection, unauthenticated, cwe-1287.networkCriticalardupilotmavlinkdronenan-injectionunauthenticatedcwe-1287https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Critical severity — network · CVE-2026-0651 (chained with CVE-2026-0652, CVE-2026-0653). Status: Weaponized. Affects: TP-Link Tapo C260 IP camera (pre-patch firmware, shared /bin/main omnibus binary across models). Tags: iot, ip-camera, tp-link, tapo, path-traversal, command-injection, privilege-escalation, exploit-chain.networkCriticaliotip-cameratp-linktapopath-traversalcommand-injectionprivilege-escalationexploit-chainhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Critical severity — network · CVE-2026-11834. Status: Weaponized. Affects: TP-Link router firmware (libcmm.so DHCP client), tested on Archer C20 V6. Tags: tp-link, router, dhcp, command-injection, cwe-78, race-condition, rce, iot.networkCriticaltp-linkrouterdhcpcommand-injectioncwe-78race-conditionrceiothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8697-tplink-archer-c64-ssh-ratelimit-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8697-tplink-archer-c64-ssh-ratelimit-bypass/Critical severity (CVSS 9.3) — network · CVE-2026-8697. Status: PoC. Affects: TP-Link Archer C64 router firmware ("TPOS"). Tags: tplink, archer-c64, router, ssh, rate-limit-bypass, authentication-oracle, brute-force, iot.networkCriticaltplinkarcher-c64routersshrate-limit-bypassauthentication-oraclebrute-forceiothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/High severity — network · CVE-2026-11499. Status: PoC. Affects: Tenda HG7 / HG9 / HG10 routers (firmware family HG7_HG9_HG10re_300001138_en_xpon and similar). Tags: tenda, router, buffer-overflow, cwe-121, dos, embedded, iot, rce.networkHightendarouterbuffer-overflowcwe-121dosembeddediotrcehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38426-tasmota-fetchjpg-strcpy-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38426-tasmota-fetchjpg-strcpy-overflow/Critical severity (CVSS 9.8) — network · CVE-2026-38426. Status: PoC. Affects: Arendst Tasmota (ESP32 firmware). Tags: tasmota, esp32, iot, buffer-overflow, strcpy, rce, mjpeg, scripter.networkCriticaltasmotaesp32iotbuffer-overflowstrcpyrcemjpegscripter