CYFIRMA’s Fortnightly Exploit Radar Highlights Five Vulnerabilities
Summary
CYFIRMA’s fortnightly roundup lists five vulnerabilities affecting products including Wasmtime, TOTOLINK A950RG and Signal K Server, reports a 13.69% increase over the prior two weeks, and provides prioritization and mitigation guidance.
Key points
- The roundup lists five CVEs and reports a 13.69% increase in vulnerabilities compared with the previous two weeks.
- It identifies vulnerable versions and fixes for Wasmtime, danmu_api and Signal K Server; no fixed versions are specified for the TOTOLINK A950RG router or Shelter Android app.
- The stated risks include Wasmtime sandbox escape, authentication bypass in danmu_api, remote router compromise, unauthorized access to Shelter’s Binder service API, and exposure of Signal K Server log archives and JWT secrets.
- CYFIRMA recommends upgrading where fixes are available, restricting access to vulnerable services and management interfaces, strengthening authentication, and monitoring for suspicious activity.
- For products without a specified fix, the article advises applying access controls and following vendor advisories.
Article Details
- Event Type
- Fortnightly vulnerability roundup and mitigation guidance
- Impact
- The report highlights five vulnerabilities affecting Wasmtime, danmu_api, TOTOLINK A950RG, Shelter Android App, and Signal K Server. Depending on the affected product and configuration, exploitation may enable sandbox escape, authentication bypass, server configuration changes, router compromise, unauthorized access to Android services or preferences, or access to sensitive logs and server control. The report recommends upgrading where fixes are available and restricting access to vulnerable systems.
CVE
Vendors
Products
danmu_apiUpgrade danmu_api to 1.21.7 or later.Shelter Android AppCVE-2026-107058 – Shelter Android App: Yes, if you use the affected Shelter Android app versionCode 445.Signal K ServerUpgrade Signal K Server to 2.33.0 or later.TOTOLINK A950RGCVE-2026-116508 – TOTOLINK A950RG: Yes, if you use the affected router firmware version 4.1.2cu.5268_B20221104.WasmtimeUpgrade Wasmtime to versions 36.0.19 or 43.0.0.