References https://nvd.nist.gov/vuln/detail/CVE-2023-28770 https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-multiple-zyxel-devices/ https://www.sentinelone.com/vulnerability-database/cve-2023-28770/ https://attackerkb.com/topics/tPAvkwQgDK/cve-2023-28770 https://cn-sec.com/archives/797676.html https://blog.csdn.net/ptsecurity/article/details/131443904 https://github.com/Nriver/wy876-POC https://www.rapid7.com/db/modules/exploit/linux/http/zyxel_lfi_unauth_ssh_rce/
Related VulnerabilitiesPoCCVE-2026-19598: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX RouterPoCCVE-2026-19900: LB-LINK Routers - Unauthenticated Command Injection9Router /api/cli-tools/cowork-settings 命令执行漏洞(CVE-2026-63732)PoCCVE-2026-46339: 9Router <= 0.4.36 - Unauthenticated RCEPoCCVE-2026-59801: 9Router - Unauthenticated LLM Provider API ExposurePoC9router-default-login: 9Router - Default Login9Router /api/cli-tools/cowork-settings 命令执行漏洞(CVE-2026-46339)9router /api/tunnel/tailscale-install 命令执行漏洞PoCCVE-2026-54236: vLLM <= 0.23.0 - Anthropic Router Heap Address Information LeakPoCBLINK Routers /goform/set_cmd 命令执行漏洞(CVE-2025-1609)BLINK routers /goform/set_hidessid_cfg 命令执行漏洞(CVE-2025-45985)Zyxel Keenetic路由器存在未授权访问漏洞Cisco Any Router and Switch 默认口令漏洞