Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en UTT HiPER 1200GW hasta versión 2.5.3-170306

Se ha identificado una debilidad en los equipos UTT HiPER 1200GW (versiones hasta 2.5.3-170306) que permite un desbordamiento de búfer basado en pila mediante manipulación remota del parámetro 'timestart' en la función strcpy del archivo /goform/formGroupConfig. Con puntuación CVSS 9.9, este dispositivo ampliamente utilizado en redes corporativas de LATAM como gateway de seguridad es vulnerable a ejecución remota de código. El exploit está disponible públicamente, elevando significativamente el riesgo de compromiso.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

Vulnerabilidad crítica en UTT HiPER 1250GW permite ejecución remota de código (CVE-2026-76004)

Se ha identificado una vulnerabilidad de desbordamiento de búfer en la pila (stack-based buffer overflow) en UTT HiPER 1250GW versiones hasta 3.2.7-210907-180535. El fallo existe en el manejador HTTP del formulario /goform/aspApBasicConfigUrcp y puede ser explotado remotialmente sin autenticación manipulando el parámetro pvid. El exploit está públicamente disponible, poniendo en riesgo crítico los equipos desplegados en infraestructuras de ISPs, centros de datos y operadores de telecomunicaciones en América Latina.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-75976] A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of …

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75877] A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function Syst…

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75784] A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the functio…

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75783] A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulner…

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-54758] Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs…

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-73522] COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthentic…

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts da…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-71979] INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f,…

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf()…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en routers Wavlink WN531P3 y WN535M1

Se identificó una vulnerabilidad de desbordamiento de búfer en la pila (stack-based buffer overflow) en los routers Wavlink WN531P3 y WN535M1 versión V250922. La falla reside en la función strcpy del componente Export Pingortrace CGI (/etc/lighttpd/www/cgi-bin/export_pingortrace.cgi) y puede ser explotada remotamente manipulando el parámetro HTTP_COOKIE. El exploit ha sido divulgado públicamente, aumentando el riesgo para infraestructuras de telecomunicaciones y empresas en LATAM que utilizan estos equipos.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

16/08/2026

[CVE-2026-19959] A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetu…

A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclos…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19847] A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the functi…

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19846] A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function s…

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19844] A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the func…

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19845] A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function s…

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19823] A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the f…

A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19824] A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element i…

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19822] A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the…

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19815] A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is th…

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19814] A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setM…

A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD