🚨 CVE-2026-7538 (CRITICAL, CVSS 9.3): Totolink A8000RU 7.1cu.643_b20200521 OS command injection in CGI handler allows unauthenticated remote code execution. No patch — restrict access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-7538-os-command-injection-in-totolink-a80-28438d15 #OffSeq #CVE20267538 #IoTSecurity #Vuln

Interesting and surprising corner-case discovered by @phils when debugging an issue with IPv6-only DNS recursive resolvers:

https://mailarchive.ietf.org/arch/msg/dnsop/rAbaKS5YD0iYuIg9xOPt0s7HJCg/

In-particular, it is important to have both A and AAAA records on all of the nameserver names (ie, that NS records point to). Just having two of each isn't enough -- the number of names without AAAA records is also a consideration.

Unbound's defenses for CVE-2020-12662 can otherwise kick in and result in SERVFAILs in some corner-cases.

#IPv6 #IPv6only #DNS