{"vulnerability": "CVE-2026-6674", "sightings": [{"uuid": "8733bbeb-e077-48da-a23d-a203aebf2359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6674", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjydw4ylkk2k", "content": "", "creation_timestamp": "2026-04-21T06:24:38.325536Z"}, {"uuid": "74c57dfe-0b69-48ce-b499-3b2491f9f79e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6674", "type": "seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mkjvtqaiuw2s", "content": "", "creation_timestamp": "2026-04-28T06:01:11.553314Z"}, {"uuid": "8213293e-308a-49bc-8e6f-6e62106541c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:10:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:03:19.733817Z"}, {"uuid": "1fbbcd10-334c-475c-8d82-95f936fea9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://infosec.exchange/users/catc0n/statuses/117042451920559868", "content": "Today, VulnCheck is disclosing #ENDLESSDOORS, a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.\nThe implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position. \nThe VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).\nhttps://www.vulncheck.com/blog/zbt-endlessdoors", "creation_timestamp": "2026-08-05T10:34:46.528224Z"}, {"uuid": "d566dd91-d6d4-43bb-ab87-961f51829cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b", "content": "CVE-2026-66747 - cpe2801 firmware\nThe Zbtlink router has a hidden program that allows an attacker to control the router remotely without a password. This could allow an attacker to make changes to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpe2801firmware #zbtlink #CVE #infosec", "creation_timestamp": "2026-08-05T11:30:05.453959Z"}, {"uuid": "e2fa9239-3833-46a9-bf35-81606baea952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117044221640947736", "content": "CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-66747/", "creation_timestamp": "2026-08-05T18:04:52.303302Z"}, {"uuid": "5a4d4b98-9115-44cc-b672-447effbaf038", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "Telegram/STxGsrhQP6hZxkehr2eSvviXIon440Ogfxey7gY5WpdfDHc", "content": "", "creation_timestamp": "2026-08-22T08:00:03.942190Z"}, {"uuid": "8988671d-face-4b41-9621-0a745a4e5412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mshj6yyyyy27", "content": "CVE-2026-66747: a Zbtlink router backdoor named ENDLESSDOORS gives unauthenticated remote code execution as root. No fix exists. CVSS 9.8.\n\n#Zbtlink #RouterBackdoor #CVE #IoT #CyberSecurity", "creation_timestamp": "2026-08-07T02:30:34.605012Z"}, {"uuid": "6507c8e6-35a3-4d91-b0a2-ed0e8e06baed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "published-proof-of-concept", "source": "Telegram/STxGsrhQP6hZxkehr2eSvviXIon440Ogfxey7gY5WpdfDHc", "content": "", "creation_timestamp": "2026-08-23T00:00:40.804088Z"}, {"uuid": "5a995cf7-2471-4e84-9d8a-f70b921021ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w", "content": "\ud83d\udfe0 CVE-2026-66748 - High (8.8)\n\nCamaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnera...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66748/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T17:01:00.967225Z"}, {"uuid": "298c198c-1f14-4ee9-a3cd-938c4f14b73d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66745", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrq4e5jyet2i", "content": "CVE-2026-66745 - Artica Proxy 4.50 Session Fixation via fw.login.php\nCVE ID : CVE-2026-66745\n \n Published : July 28, 2026, 6:10 p.m. | 29\u00a0minutes ago\n \n Description : Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulne...", "creation_timestamp": "2026-07-28T19:09:33.726243Z"}, {"uuid": "fcc625ff-6383-4df3-af57-02eba16c1917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66745", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq77z7zsg2e", "content": "\ud83d\udfe0 CVE-2026-66745 - High (7.5)\n\nArtica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session f...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66745/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T20:00:56.632291Z"}, {"uuid": "4bf785cf-2d20-460c-be81-b722dbbb8ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://t.me/GithubRedTeam/95604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:10:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T01:00:03.988638Z"}, {"uuid": "4eef325c-26bd-49df-8c64-663e812b6e33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrwmbzm7x2z", "content": "CVE-2026-66748\nCamaleon CMS versions 2.1.1 to 2.9.1 have a security flaw that allows authorized users to run unauthorized code on the server. This could lead to sensitive data being accessed or modified. To stay secure,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-29T12:32:03.986696Z"}]}