shlln/cve-2026-90847Proof-of-concept for CVE-2026-90847, an authenticated RCE in iux_set.cgi via malicious .cfg tar upload that writes commands into crontab for recurring execution.
iux_set.cgi contains an authenticated remote code execution (RCE) vulnerability via file upload. It lives in the function that's invoked when iux_set.cgi is called with tmenu=camera and smenu=system_setup, which maps to Camera Management → System Setup in the administrator web UI. Although it carries a .cfg extension, the configuration-restore file is really a tar archive: if you place an /etc/cron.cfg inside it containing the command you want to run, that command gets written into crontab semi-permanently, and unless the device is factory-reset or a new /etc/cron.cfg is uploaded, it runs on a recurring schedule. I reproduced this on real hardware — please see the video link below.
