Batch #16 - October 2026 (6 advisories · 1 critical · 1 unauth)

Six findings in four closed-source products. Each one ships a full root-cause analysis and a working PoC.

#	Product	Version	CVSS	Advisory & PoC
1	NETGEAR RAX120 (Nighthawk AX12)	V1.2.5.18	6.8	SOAP InstallApp apName → shell command substitution on the root-configured web stack
2	NUUO Crystal Server	3.19.0.85	9.8	bare copy() upload endpoint with no session, no extension gate and no path check → web-root write on one anonymous pair
3	Raritan PX3 PDU G4	4.3.14	8.8	diagnostics ping/traceroute hostname-validation return inversion, reachable by every ordinary session
4	Moxa MAR-2000	V1.0 Build 15010909	7.2	Executer program-table argument straight into the user-program launcher's command line
5	Moxa MAR-2000	V1.0 Build 15010909	7.2	five ipsec.py handlers shell out with attacker text from tunnel-address fields
6	Moxa MAR-2000	V1.0 Build 15010909	7.2	scenario thread re-evaluates a saved ping condition and re-forms the shell command each pass

Five authenticated chains and one anonymous one. Every finding reaches operating-system command execution inside the product's own service or management stack, and states its own verification boundary in so many words: where only the sandbox was used, the sandbox is named; where only disassembly was used, disassembly is named; no advisory claims what a live device never demonstrated.

All six publish more than one reading. Each advisory carries the readings it rejected or made conditional next to the one it stands behind, each with its own vector and arithmetic; four of the six publish a headline lower than the raw source record suggested, and every one of those downgrades is documented where it is made.

All six, and the 138 before them: https://0day-rubbish.com/blog