nicholas-howland/cve-2026-6992-pocVulnerability proof of concept reworked from https://github.com/utmost3/cve/issues/2 I take no credit for discovering the vulnerability. This is for educational and portfolio purposes only.
Vulnerability proof of concept for the bluetooth pin RCE injection CVE-2026-6992 reworked from https://github.com/utmost3/cve/issues/2 I take no credit for discovering the vulnerability. This is for educational and portfolio purposes only. For devices that do not have management through bluetooth capabilities this PoC may not work. JNAP requests are tricky.
This exploit should work MR9600 routers with bluetooth capabilities
usage: CVE-2026-6992-PoC.py [-h] -ti TARGETIP [-tp TARGETPORT] -lp LISTENPORT -li LISTENIP [-u USERNAME] [-p PASSWORD] [-s]
options:
-h, --help show this help message and exit
-ti, --targetIP TARGETIP
Target IP address of the vulnerable router
-tp, --targetPort TARGETPORT
Listening port for the administrative interface, defualts to 80
-lp, --listenPort LISTENPORT
Listening port on the testers machine
-li, --listenIP LISTENIP
IP address that is listening, usually 192.168.1.1
-u, --username USERNAME
Administrator username to be used, defaults to admin
-p, --password PASSWORD
Password for the administrator account, defaults to admin
-s, --https Use https instead of http, http is most common listening protocol on MR9600