CVE-2021-25812

Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client.

• CWE-77

• http://iot.10086.cn/?l=en-usProduct
• https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection.mdThird Party Advisory
• https://www.zhipinmall.com/prodetail?id=1266#skuId=3020Third Party Advisory
• http://iot.10086.cn/?l=en-usProduct
• https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection.mdThird Party Advisory
• https://www.zhipinmall.com/prodetail?id=1266#skuId=3020Third Party Advisory

Published

Apr 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25803A buffer overflow vulnerability in the vlc_input_attachment_…7.1
• CVE-2021-25804A NULL-pointer dereference in "Open" in avi.c of VideoLAN VL…7.5
• CVE-2021-25808A code injection vulnerability in backup/plugin.php of Bludi…7.8
• CVE-2021-25809UCMS 1.5.0 was discovered to contain a physical path leakage…5.3
• CVE-2021-25810Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury…6.1
• CVE-2021-25811MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service …7.5
• CVE-2021-25827Emby Server < 4.7.12.0 is vulnerable to a login bypass attac…9.8
• CVE-2021-25828Emby Server versions < 4.6.0.50 is vulnerable to Cross Site …6.1
• CVE-2021-25829An improper binary stream data handling issue was found in t…7.5
• CVE-2021-25830A file extension handling issue was found in [core] module o…9.8
• CVE-2021-25831A file extension handling issue was found in [core] module o…9.8
• CVE-2021-25832A heap buffer overflow vulnerability inside of BMP image pro…9.8