CVE-2025-9725
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 addresses this issue. The vendor explains: 'The firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters) must be manually created upon first login to the web management page.'
Risk Assessment
An attacker with local access could use the default password to gain unauthorized access to the web interface. This could lead to device takeover.
Recommendation
Update Cudy LT500E firmware to version 2.3.13 or later. After updating, set a new strong administrator password upon first login.
Related vulnerabilities
- CVE-2026-121802Critical
@better-auth/expo before 1.7.16 signs a caller-supplied state value without verifying that it was issued by the server. This allows account-takeover outcomes, such as unauthenticated changes of any account's email address.
- CVE-2026-121615Critical
Linksys E5600 1.1.0.26 contains an improper authentication vulnerability in /cgi-bin/mesh_login.cgi (Login Handler). The attack can be launched remotely and the exploit has been publicly disclosed. The vendor did not respond and the product is no longer supported.
- CVE-2026-121609Critical
A vulnerability was identified in the Qihoo 360 Whole Home Router M5 version 4.0.17.1566 within the boot script /etc/init.d/mpt (Home function). The issue involves hard-coded credentials. The exploit is publicly available and remote exploitation is possible.
- CVE-2026-121607Critical
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to version 6.4.9 in the testspeed_command function of /fs2/bin/iscm. Manipulating the host argument results in OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-121606Critical
A vulnerability was found in Qihoo 360 devices (models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9) in the verify_sign function of fs2/bin/iscm responsible for firmware signature verification. Manipulating the sign argument leads to improper verification of cryptographic signatures. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121600Critical
A vulnerability was found in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setMacFilterRules function of /cgi-bin/cstecgi.cgi handling MAC filtering. Manipulating the addEffect argument causes a stack-based buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-121599Critical
A vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setWiFiMultipleConfig/delWiFiMultipleConfig functions of /cgi-bin/cstecgi.cgi handling Multi-SSID configuration. Manipulating the wepkey2/wepkey3 arguments results in a stack-based buffer overflow. The attack can be launched remotely and the exploit is now public.
- CVE-2026-121598Critical
A security vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the strcpy function of /cgi-bin/cstecgi.cgi handling basic wireless configuration. Manipulating the wepkey argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-92190Critical
Quest Foglight for Databases contains a deserialization of untrusted data vulnerability in the baseRmiServiceExporter component. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-92189Critical
In Quest Foglight for Databases, the writeTopologySectionToFile method does not validate a user-supplied path before using it in file operations. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
Original NVD description (English source)
A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS