CVE-2026-20156

Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20156 are related to improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Roomos Software Roomos Roomos Cloud

CVE-2026-19846

TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A800r A800r Firmware

CVE-2026-19845

TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A800r A800r Firmware

CVE-2026-19814

TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow

A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A800r A800r Firmware

CVE-2026-19822

Tenda W20E QoS Edit editQos lstAdd stack-based overflow

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

W20e W20e Firmware

CVE-2026-19812

TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow

A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A800r A800r Firmware

CVE-2026-19791

Tenda G0 httpd web management interface module addStaticRoute stack-based overflow

A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

G0

CVE-2026-19824

Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

W20e W20e Firmware

CVE-2026-19789

Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow

A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

Ac1206 Ac1206 Firmware

CVE-2025-43441

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipad Os Ipados and 11 more

CVE-2025-43433

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipados Iphone Os and 11 more

CVE-2026-19815

TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A800r A800r Firmware

CVE-2026-19792

Tenda G0 httpd web management interface module setPortMapping buffer overflow

A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

G0

CVE-2026-68172

arm64: make huge_ptep_get handled unaligned addresses

In the Linux kernel, the following vulnerability has been resolved: arm64: make huge_ptep_get handled unaligned addresses huge_ptep_get() can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio (examples of callers are pagemap_hugetlb_range, page_mapped_in_vma). The arm64 helper rewalks the pgtables in find_num_contig to answer whether the huge pte we have maps a contpmd or a contpte hugetlb folio, and returns CONT_PMDS or CONT_PTES, so that it can collect a/d bits over the contiguous ptes. We can falsely return CONT_PTES instead of CONT_PMDS if the addr is not aligned. On systems where CONT_PTES != CONT_PMDS (meaning page size is 16K), we could collect excess A/D bit state, meaning extra work for the kernel. Even worse, we may iterate beyond the PTE table and dereference a garbage ptep pointer to access physical memory we don't own. Since the ptep pointer is a linear map address, we may run off the end of the linear map or into a hole, dereference a VA not mapped into the kernel pgtables and cause kernel panic. Fix this by aligning the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer, to correctly answer whether the huge pte is the base of a contpmd block.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-8989

Open Recovery Mode

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Autel

Products

Maxicharger Single Charger Maxicharger Single Charger Firmware

CVE-2026-8988

Access to Bootloader

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Autel

Products

Maxicharger Single Charger Maxicharger Single Charger Firmware

CVE-2024-14042

Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue. The patch is named e89aa79efe629ae90f59dcdf8847c117d9a7da86. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2025-15685

Open5GS freeDiameter memory corruption

A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation causes memory corruption. The attack is possible to be carried out remotely.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2024-14044

Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow

A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.7.2 is capable of addressing this issue. The identifier of the patch is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2024-14043

Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow

A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a manipulation of the argument msisdn_len can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.2 is able to resolve this issue. This patch is called 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs