CVE-2025-26320: t0mer Broadlinkmanager

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping.

Affected products

• t0mer Broadlinkmanager: up to and including 5.9.1

Published 2025-03-04. Last modified 2026-06-17.