InfoSecBulletin Cybersecurity for mankind
TP-Link has shared a security warning about a serious problem with its TL-WR940N V6 wireless router. This problem, known as CVE-2026-12935, might let attackers who haven’t logged in cause a denial-of-service issue or run their code on affected devices in some situations.
According to TP-Link, the vulnerability is caused by a stack-based buffer overflow. This occurs when specially crafted data exceeds the allocated memory.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
If a hacker runs code from afar, it is a big security danger. They could change network settings, capture data, modify DNS settings, install harmful software that stays, or use the hacked router to attack other devices on the local network.
The flaw has a CVSS v4.0 score of 8.7 out of 10, which is High. It can be attacked through the network, is easy to exploit, and does not need any login.
TP-Link said that this problem only affects the TL-WR940N hardware version V6. The company has issued firmware updates to fix the issue in supported regions.
The fixed releases have firmware version (EN)_V6_260528 for English devices, (US)_V6_260528 for US devices, and (JP)_V6_260527 for Japanese devices.
Users need to check their router’s hardware version and regional firmware before installing updates. If you install firmware for a different region, it might cause problems or break your device. Only download firmware updates from TP-Link’s official support website.
Organizations and home users should stop unneeded RTSP connections from their devices until the router is updated.
SonicWall
SonicWall Secure Mobile Access, or SMA, devices that connect to the internet have a big flaw. Attackers found two flaws and were supposed to use them to gain full control of the VPN gateway. The campaign lets someone gain root access from a basic web request, without needing a password, session, or user action.
According to CSN INC Ransomware has emerged as the main actor using the full chain. The report says that exploitation started around June 22, and patches came in July. This gave organizations little time to respond.
The risk is very high because VPN devices are placed between the public internet and important internal systems.
