CVE-2021-25811

MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed.

• https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Denial%20of%20Service.mdBroken Link
• https://www.mercurycom.com.cn/product-521-1.htmlProduct, Vendor Advisory
• https://www.mercusys.com/en/Vendor Advisory
• https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Denial%20of%20Service.mdBroken Link
• https://www.mercurycom.com.cn/product-521-1.htmlProduct, Vendor Advisory
• https://www.mercusys.com/en/Vendor Advisory

Published

Apr 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25802A buffer overflow vulnerability in the AVI_ExtractSubtitle c…7.1
• CVE-2021-25803A buffer overflow vulnerability in the vlc_input_attachment_…7.1
• CVE-2021-25804A NULL-pointer dereference in "Open" in avi.c of VideoLAN VL…7.5
• CVE-2021-25808A code injection vulnerability in backup/plugin.php of Bludi…7.8
• CVE-2021-25809UCMS 1.5.0 was discovered to contain a physical path leakage…5.3
• CVE-2021-25810Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury…6.1
• CVE-2021-25812Command injection vulnerability in China Mobile An Lianbao W…9.8
• CVE-2021-25827Emby Server < 4.7.12.0 is vulnerable to a login bypass attac…9.8
• CVE-2021-25828Emby Server versions < 4.6.0.50 is vulnerable to Cross Site …6.1
• CVE-2021-25829An improper binary stream data handling issue was found in t…7.5
• CVE-2021-25830A file extension handling issue was found in [core] module o…9.8
• CVE-2021-25831A file extension handling issue was found in [core] module o…9.8