CVE-2026-35906: An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1

Synopsis

This is an unauthenticated remote command execution vulnerability in T3 Technology CPE devices (T625Pro v1.0.07 and T6825G v1.0.03), triggered by sending a crafted HTTP request to an undocumented debug CGI endpoint exposed on the network. The attack requires no credentials and only needs the victim to interact in some way (per the CVSS vector), and successful exploitation gives the attacker arbitrary command execution as root, with full read, write, and availability impact that can extend beyond the vulnerable device itself (scope is changed). No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's HTTP service over the network; the debug CGI endpoint is exposed remotely, making internet- or LAN-accessible deployments directly at risk.

• AuthenticationNot required

  No credentials are needed; the debug endpoint accepts unauthenticated requests and processes the crafted query string without any login check.

• Victim interactionRequired

  The CVSS vector specifies UI:R, meaning some form of user interaction is required to trigger the exploit, such as a victim browsing to a crafted URL or clicking an attacker-supplied link.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special environmental conditions, race timing, or memory layout requirements on the attacker.

Blast Radius

• A successful attacker executes arbitrary operating system commands as root on the affected CPE device, gaining complete control of the underlying system.
• With root access, the attacker reads all stored configuration, credentials, and any secrets held on the device.
• The attacker can modify device configuration, routing rules, or firmware, enabling persistent access or lateral movement into the adjacent network.
• Because scope is changed in the CVSS vector, impact can extend beyond the CPE itself to downstream systems and network segments the device routes or bridges.