CVE-2025-9576
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688, affecting an unknown function of the file /etc/shadow (Administrative Interface component). Manipulation leads to the use of default credentials. The attack requires local access and is highly complex. The exploit is publicly available and the vendor did not respond to the disclosure.
Risk Assessment
An attacker with local access could exploit default credentials to gain unauthorized access to the administrative interface. The vendor's lack of response means no official patch is available.
Recommendation
Immediately change default passwords and disable unused accounts. Restrict local access to the device and monitor login attempts.
Related vulnerabilities
- CVE-2026-121802Critical
@better-auth/expo before 1.7.16 signs a caller-supplied state value without verifying that it was issued by the server. This allows account-takeover outcomes, such as unauthenticated changes of any account's email address.
- CVE-2026-121615Critical
Linksys E5600 1.1.0.26 contains an improper authentication vulnerability in /cgi-bin/mesh_login.cgi (Login Handler). The attack can be launched remotely and the exploit has been publicly disclosed. The vendor did not respond and the product is no longer supported.
- CVE-2026-121609Critical
A vulnerability was identified in the Qihoo 360 Whole Home Router M5 version 4.0.17.1566 within the boot script /etc/init.d/mpt (Home function). The issue involves hard-coded credentials. The exploit is publicly available and remote exploitation is possible.
- CVE-2026-121607Critical
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to version 6.4.9 in the testspeed_command function of /fs2/bin/iscm. Manipulating the host argument results in OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-121606Critical
A vulnerability was found in Qihoo 360 devices (models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9) in the verify_sign function of fs2/bin/iscm responsible for firmware signature verification. Manipulating the sign argument leads to improper verification of cryptographic signatures. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121600Critical
A vulnerability was found in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setMacFilterRules function of /cgi-bin/cstecgi.cgi handling MAC filtering. Manipulating the addEffect argument causes a stack-based buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-121599Critical
A vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setWiFiMultipleConfig/delWiFiMultipleConfig functions of /cgi-bin/cstecgi.cgi handling Multi-SSID configuration. Manipulating the wepkey2/wepkey3 arguments results in a stack-based buffer overflow. The attack can be launched remotely and the exploit is now public.
- CVE-2026-121598Critical
A security vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the strcpy function of /cgi-bin/cstecgi.cgi handling basic wireless configuration. Manipulating the wepkey argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-92190Critical
Quest Foglight for Databases contains a deserialization of untrusted data vulnerability in the baseRmiServiceExporter component. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-92189Critical
In Quest Foglight for Databases, the writeTopologySectionToFile method does not validate a user-supplied path before using it in file operations. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
Original NVD description (English source)
A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Interface. The manipulation leads to use of default credentials. An attack has to be approached locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS