AI Agent Uncovers Unauthenticated Router Config Dump Leading to CVE Filing

An LLM agent tasked only with documenting network topology independently discovered a critical authentication bypass in a home router firmware. The agent performed read-only reconnaissance, extracted the full configuration including base64-encoded admin passwords and WPA2 keys via an unprotected CGI endpoint, and verified the finding by obtaining a valid session cookie. It then produced a complete coordinated disclosure report, classified the issue under CWE-306 with a CVSS 3.1 score of 8.8, and prepared the MITRE CVE submission package. The vulnerability affects LAN-side management interfaces of certain SOHO routers running legacy Boa web servers and remains unpatched due to inaccessible vendor firmware channels. The researcher maintained strict read-only permissions for the agent throughout the process, ensuring no configuration changes occurred. The case demonstrates how autonomous agents can accelerate vulnerability research while staying within defined operational boundaries.

HabrAugust 30, 2026Translated from Russian

Read at source

An experienced security engineer running a home lab with Proxmox VE asked an LLM agent to document router administration methods. The agent was given only basic port information and instructed to verify available functionality. Overnight the agent located an unauthenticated configuration read endpoint on the router’s web interface.

The endpoint returned approximately 37 KB of configuration data containing the administrative password in base64, all WPA2 pre-shared keys, service credentials, and full network settings. The agent confirmed that the corresponding write endpoint correctly required authentication, indicating a design flaw rather than an intentional backdoor. It then used the extracted credentials to obtain a valid session cookie, proving full administrative access was possible from any device on the LAN.

Technical details and classification

The router runs an ancient Boa web server exposing a single-page application built with jQuery. JavaScript bundles revealed the real API endpoints. The flaw was classified as CWE-306 Missing Authentication for Critical Function, with secondary weaknesses CWE-522 and CWE-359. The agent calculated a CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

External scans confirmed the issue is strictly LAN-facing because WAN management remains disabled. The researcher could not locate current firmware updates due to unresponsive vendor infrastructure, a fact also included in the disclosure.

Path to CVE registration

The agent prepared a bilingual coordinated disclosure report for the vendor and assembled the required fields for the MITRE CNA-LR submission using knowledge of the Vulnogram form. The researcher personally sent the email and submitted the CVE request. A parallel entry was created in VulDB. The 90-day disclosure window is now open.

Key takeaways for agent use in security research

Read-only permission boundaries successfully limited the agent to reconnaissance and verification steps.
The agent performed exhaustive enumeration of JavaScript files, endpoints, and public vulnerability databases far faster than a human researcher.
Final actions requiring accounts or submissions remained under human control.
Home labs provide a safe, legal environment for testing autonomous security agents.

MITRE CVSS 3.1 CWE-306 Proxmox VE Vulnogram Boa

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.

Security NEXTOct 29, 2026Translated from Japanese