CVE-2026-35906
An undocumented debug CGI endpoint in certain T3 Technology devices lets anyone on the network run commands as the system’s root user without needing a password. Because the flaw can be triggered from a simple web request, it is considered a critical vulnerability.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
T3 Technology CPE models T625Pro v1.0.07 and T6825G v1.0.03.
Real-world impact
An attacker who can reach the device could run any command with root privileges, potentially taking full control of the device, compromising connected networks, or using it as a launch point for further attacks.
Why this severity
The CVSS score of 9.6 reflects that the flaw is exploitable over the network (AV:N), requires no special privileges (PR:N), has low complexity (AC:L), and can be triggered by a user interacting with the web interface (UI:R). It also grants complete confidentiality, integrity, and availability damage (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.