Routing, Switching & Wi-Fi
CISA Adds MikroTik RouterOS SSH Bypass to KEV
The KEV-listed RouterOS SSH bypass requires branch-matched updates and management-access restrictions. Preserve recovery access and inspect router configuration and security indicators; a successful patch or clean indicator alone does not establish an uncompromised appliance.
Ubiquiti UniFi Gateway Updates Fix Six Denial-of-Service Flaws
Six UniFi gateway flaws can cause network-triggered denial of service. Match firmware to the exact device model, distinguish Express from Express 7, and prepare configuration backups and recovery access before updating.
Arista Warns of Exploited VeloCloud Orchestrator RCE
Arista reports active exploitation of the VeloCloud Orchestrator flaw and says hosted services were patched. On-premises operators should restrict management access, preserve evidence and obtain the branch-specific fix, including guidance where no fix is listed.
CISA Adds Zyxel GS1900 Command Execution Flaw to KEV
The exploited Zyxel GS1900 flaw lets an unauthenticated LAN attacker execute commands through a vulnerable CGI program. Restrict management access, preserve logs for triage, and install firmware matched to the exact switch model.
CVE-2022-20775: Cisco SD-WAN authenticated local path traversal to root
Cisco SD-WAN's CLI path-traversal flaw requires authenticated local access and can grant root privileges. Inventory affected control and edge components, excluding IOS XE SD-WAN; historical fix thresholds do not establish protection from newer fabric vulnerabilities.
CVE-2025-29635: D-Link DIR-823X authenticated command injection on an end-of-life router
Authenticated command injection affects the end-of-life D-Link DIR-823X. D-Link directs retirement and replacement across hardware revisions; its support page's Resolved label is not a firmware fix or evidence that an exposed router was uncompromised.
CVE-2026-7473: Arista EOS tunnel decapsulation validation flaw
Affected Arista EOS switches can forward unexpected tunnel traffic sent to a configured decapsulation IP. Arista specifies ACL mitigation, not a software upgrade; plan filters around shared-IP services and potentially disruptive TCAM changes.
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Legacy Cisco IOS 12.4 request forgery can misuse a signed-in administrator's browser to issue commands. The linked retirement notice does not identify a fixed image; confirm a hardware-compatible supported migration and preserve management evidence.
CVE-2026-34910: UniFi OS input-validation flaw
UniFi OS input-validation failures can permit command injection from an attacker with network access. Match the exact console or server product to its fixed release, then review system and access logs for unexplained activity.
CVE-2026-34909: UniFi OS path traversal
UniFi OS path traversal can expose underlying files to an attacker with network access. Apply the product-specific update and preserve access logs; the reviewed scope does not establish arbitrary file upload or placement.