Sunday Sweep: The Automation Platform, The Dead Router, and The Meeting App
Three Gaps, Three Shovels
Our Sunday morning sweep found holes in our coverage. Time to fill them.
1. n8n: Two CVSS 10.0s Walk Into a Webhook
If you run n8n for workflow automation, stop reading and patch first.
CVE-2026-21858: The Content-Type Confusion
CVSS: 10.0 - It doesn't get worse than this.
| Field | Value |
| Affected | n8n < 1.121.0 |
| Attack | Unauthenticated RCE |
| Vector | Webhook endpoint |
| Complexity | Low |
The Attack Chain:
- Send HTTP request with crafted Content-Type header
- Override req.body.files object (no actual file upload needed)
- Read arbitrary local files from server
- Extract SQLite database: /home/node/.n8n/database.sqlite
- Harvest admin credentials
- Retrieve encryption secrets from /home/node/.n8n/config
- Forge valid admin session cookies
- Create malicious workflow with "Execute Command" node
- Full system compromise
Security researcher Dor Attias: "Since this function is called without verifying the content type is 'multipart/form-data,' we control the entire req.body.files object."
The n8n webhook doesn't verify Content-Type headers match the parser being used. Classic confusion bug, catastrophic impact.
CVE-2026-21877: The Git Node Gambit
CVSS: 10.0 - Yes, another one.
| Field | Value |
| Affected | n8n 0.123.0 to < 1.121.3 |
| Attack | Authenticated RCE |
| Vector | Git node functionality |
| Complexity | Low |
"Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n service."
If you give users access to n8n workflows, any of them can pop the box.
Why n8n Matters
- OAuth tokens for every connected service
- Database credentials
- API keys
- Webhook secrets
- The keys to your entire automation kingdom
One compromised n8n instance = lateral movement buffet.
Patch Now
| Version | Status |
| < 1.121.0 | Vulnerable to both |
| 1.121.0 - 1.121.2 | Vulnerable to CVE-2026-21877 |
| 1.121.3+ | Patched |
| 1.123.10+ | Patched |
| 2.1.5+ | Patched |
- Disable the Git node
- Restrict access to trusted users only
- Put it behind a VPN
2. D-Link: The Routers That Won't Die (But Should)
CVE-2026-0625: Command Injection in Dead Hardware
CVSS: 9.3 - Actively exploited in the wild.
| Field | Value |
| Affected | DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B |
| Attack | Unauthenticated RCE |
| Vector | dnscfg.cgi endpoint |
| Status | No patch. EOL since 2020. |
- 2020: D-Link EOLs these routers
- Nov 27, 2025: Shadowserver detects exploitation
- Dec 16, 2025: VulnCheck reports active attacks
- Jan 2026: Still being exploited
The Attack
POST /dnscfg.cgi HTTP/1.1
Host: <router_ip>
Content-Type: application/x-www-form-urlencodeddns1=8.8.8.8;whoami;&dns2=8.8.4.4
```
DNS configuration parameters aren't sanitized. Semicolon = shell command execution.
What Attackers Do With Your Router
| Use Case | Impact |
| DNS hijacking | Redirect all traffic to attacker-controlled servers |
| Botnet recruitment | DDoS attacks, crypto mining |
| Traffic interception | Steal credentials, inject malware |
| Lateral movement | Pivot into internal network |
| Proxy services | Hide attack origin |
The GhostDNS Connection
This vulnerability is in the same family as GhostDNS and DNSChanger campaigns that compromised millions of routers from 2016-2019. The PyPhp variant operated across 100+ C2 servers with scripts targeting routers on both public internet and internal networks.
History is rhyming.
The Only Fix
Replace the router.
There is no patch. There will never be a patch. D-Link stopped supporting these devices in 2020.
- DSL-526B ≤ 2.01
- DSL-2640B ≤ 1.07
- DSL-2740R < 1.17
- DSL-2780B ≤ 1.01.14
Unplug it. Today.
3. Zoom: The DLL That Wasn't There
CVE-2025-49457: Privilege Escalation via DLL Hijacking
CVSS: 9.6 - Windows only. Patched. No active exploitation.
| Field | Value |
| Affected | Zoom for Windows < 6.3.10 |
| Attack | DLL hijacking |
| Vector | Network share |
| Complexity | Medium |
The Attack
- Application directory
- System directories
- PATH directories
- Network shares
An attacker places malicious DLL on a network share. User triggers Zoom to load that DLL. Attacker's code runs with user's permissions.
Affected Products
- Zoom Workplace for Windows < 6.3.10
- Zoom Workplace VDI for Windows < 6.3.10
- Zoom Rooms for Windows < 6.3.10
- Zoom Rooms Controller for Windows < 6.3.10
- Zoom Meeting SDK for Windows < 6.3.10
Credit Where Due
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Zoom's internal Offensive Security team found this proactively. That's how it should work.
Patch Status
Fixed in version 6.3.10. Update and move on.
The Pattern
| Vulnerability | Root Cause | Status |
| n8n CVE-2026-21858 | Input validation failure | Patch available |
| n8n CVE-2026-21877 | Insufficient access control | Patch available |
| D-Link CVE-2026-0625 | Input validation failure | No patch ever |
| Zoom CVE-2025-49457 | Insecure DLL loading | Patched |
Three of four have patches. One never will.
The D-Link routers are the real story. They've been dead since 2020, but they're still on networks, still internet-facing, still being exploited. Every one is a ticking time bomb.
Detection
n8n Exploitation Indicators
- Unusual webhook traffic patterns
- Access to /home/node/.n8n/database.sqlite
- Unexpected workflow creation
- "Execute Command" nodes you didn't create
- Session cookie anomalies
D-Link Exploitation Indicators
- DNS settings changed without authorization
- Traffic redirected to unknown servers
- Outbound connections to C2 infrastructure
- Unusual bandwidth consumption
Zoom DLL Hijacking
- Zoom processes loading DLLs from network shares
- Unexpected DLL files in Zoom directories
- Privilege escalation attempts post-Zoom launch
Recommendations
Immediate (Today)
- Patch n8n to 1.121.3 or later
- Replace D-Link DSL routers - no exceptions
- Update Zoom to 6.3.10 or later
This Week
- Audit network for EOL devices
- Review n8n workflow permissions
- Enable auto-update for Zoom clients
Ongoing
- Maintain inventory of network devices with EOL dates
- Establish replacement timeline before EOL hits
- Monitor threat intel for active exploitation
STIX Feed Updated
These CVEs are now tracked in our feed:
curl https://analytics.dugganusa.com/api/v1/stix-feedOTX Pulse: https://otx.alienvault.com/user/pduggusa
The Uncomfortable Truth
The n8n vulnerabilities will get patched. The Zoom vulnerability already is.
But those D-Link routers? They're still out there. In homes. In small businesses. In places where "it still works" trumps "it's a security risk."
Six years after EOL. Still exploited. Still no fix coming.
The lesson isn't about any single CVE. It's about the infrastructure we forget exists until someone else remembers it for us.
- n8n CVE-2026-21877 Advisory
- n8n CVE-2026-21858 Technical Analysis
- D-Link CVE-2026-0625 Active Exploitation
- D-Link Security Announcement
- Zoom CVE-2025-49457 Analysis
- Shadowserver Foundation
- VulnCheck Advisory
Her name is Renee Nicole Good.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=sunday-sweep-the-automation-platform-the-dead-router-and-the-meeting-app