Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-54322 (ZERODAY) - Unauthenticated Root RCE affecting ~70,000+ Hosts

pwn.ai | vulnerability | Critical | CVE-2025-54322 | #ai-security | #rce | #zero-day | #autonomous-agents | #pre-auth-rce | #cve-2025-54322 | #edge-devices | #vendor-disclosure

Summary

pwn.ai's agent-found zero-day: CVE-2025-54322 yields unauthenticated root RCE on Xspeeder SXZOS edge devices, tens of thousands exposed, disclosed after seven months of vendor silence.
CVE
CVE-2025-54322
CVSS
9.8
Published
Collected

original ↗

Related coverage

blog · xbow.com
Introducing Autonomous Exposure Management: Offensive Security at Enterprise Scale
XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
tool · github.com
Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)
Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
research · github.com
[CVE-2024-6100] CyberKimi Benchmarks: Autonomous Exploitation Traces & Evidence
Provides verifiable, transparent evidence of advanced LLMs performing complex, multi-step binary and browser exploitation autonomously under strict ASLR and memory randomization defenses.
research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
back