CVE-2026-35906: Unauthenticated RCE in T3 Technology T625Pro via Debug CGI Endpoint

Vulnerability Overview CVE-2026-35906: Unauthenticated Remote Code Execution via Debug CGI Endpoint Description: An undocumented debug CGI endpoint exists in the T3 Technology T625Pro CPE device, allowing unauthenticated attackers to execute arbitrary operating system commands with root privileges by providing a malicious HTTP query string. This vulnerability requires no authentication and can be exploited from external networks via blind CSRF. CVSS Score: 9.6 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products Confirmed Affected Products: - Model: T3 Technology T625Pro - Hardware: V1.0 - Firmware Version: V1.07 Suspected Affected Products: - Model: T3 Technology T6825G, T3 Technology T628, T3 Technology T628L - Reason: These models share the same codebase as the T625Pro. RCE has been verified via similar vectors, but specific endpoint PoCs were not captured. Remediation Immediate Action: Remove or disable the debug CGI endpoint in production firmware. Defense in Depth: All CGI endpoints must enforce session-based authentication. Input Validation: Debug endpoints should never be present in release firmware. User Recommendation: Restrict access to the CPE management interface via network segmentation. Vulnerability Details Type: Missing Authentication for Critical Function (CWE-306), Exposure of Dangerous Method or Function (CWE-749), Active Debug Code (CWE-489). Related: OS Command Injection (CWE-78). Component: Authentication Required: None Impact: Arbitrary command execution with root privileges Proof of Concept (PoC) Direct (from LAN) — Output Returned in Response Blind CSRF (from WAN/External) Attack Scenarios Scenario 1: Direct LAN Access 1. The attacker navigates to the debug CGI URL with a command payload while on the same LAN. 2. The command is executed with root privileges immediately, and the output is returned in the response. Scenario 2: Remote Exploitation via Blind CSRF 1. The attacker hosts a malicious webpage on the internet. 2. The victim (any user behind the target CPE) accesses the page. 3. The browser silently sends a request to the CPE's LAN IP. 4. Arbitrary commands are executed with root privileges on the CPE device. 5. The attacker can establish persistence, exfiltrate configurations, or move laterally within the internal network. Full Kill Chain Timeline Credits Discovered by: pwnOnu References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35906 https://t3techgroup.com/ https://www.ncsa.or.th/

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-35906: Unauthenticated RCE in T3 Technology T625Pro via Debug CGI Endpoint

More from this source