tc4dy/cve-2026-0073-poc-exploit🚀 CVE-2026-0073 - Android ADB Wireless Debugging Exploit (CVSS 8.8) 🔓 Zero-click authentication bypass via TLS type confusion. Gain interactive shell, execute commands, scan networks. Educational red-team tool. 🐚⚡
Zero-Click | Remote Shell | Network Scanner | Educational Security Research Tool
CVE-2026-0073 is a critical authentication bypass vulnerability in Android's ADB daemon affecting Wireless Debugging on Android 11+ devices. The flaw resides in the TLS certificate verification logic where a type confusion in EVP_PKEY_cmp() allows attackers to bypass authentication by presenting an EC P-256 or Ed25519 certificate against a device configured with an RSA key.
This PoC demonstrates the vulnerability for authorized security research and educational purposes only.
| Android Version | Affected |
|---|---|
| Android 14 | ✅ Yes |
| Android 15 | ✅ Yes |
| Android 16 | ✅ Yes |
| Android 13- | ❌ No |
Patch: Android Security Bulletin 2026-05-01
#Basic - One Shot Exploit
python exploit.py --target 192.168.1.100
#Interactive Shell
python exploit.py -t 192.168.1.100 -i
#Execute Single Command
python exploit.py -t 192.168.1.100 -c "id" -o result.txt
#Scan Entire Network
python exploit.py --scan --interface eth0
#Manual Port + Verbose
python exploit.py -t 192.168.1.100 -p 39311 -v
#Ed25519 Certificate
python exploit.py -t 192.168.1.100 --key-type ed25519
#Non-Interactive Mode (Exit After Command)
python exploit.py -t 192.168.1.100 -c "whoami" --no-interactive
Check out my other exploit repositories:
| Feature | Description |
|---|
| 🔍 Smart Port Discovery | Automatically scans 30000-50000 range + common ports, verifies ADB via CNXN handshake |
| 🔐 TLS 1.3 Bypass | Exploits type confusion in EVP_PKEY_cmp() for authentication bypass |
| 🎨 Dual Key Support | EC P-256 (default) or Ed25519 certificates |
| 🐚 Interactive Shell | Full terminal access with thread-based I/O |
| ⚡ Single Command Mode | Execute one command and exit - perfect for scripting |
| 📡 Network Scanner | Scan entire subnet for vulnerable devices |
| 🔄 Auto Retry | Exponential backoff + configurable max retries |
| 🎯 Manual Port Override | Specify port when auto-discovery fails |
| 📁 Output Capture | Save command results to file |
| 🎨 Colorized Output | Professional visual feedback via colorama |
| 🪵 Verbose Debug | Detailed logging for troubleshooting |
| 🔌 Proxy Support | HTTP/HTTPS proxy compatibility |
| 🧵 Threaded Shell | Non-blocking interactive session |
| Argument | Short | Default | Description |
|---|
--target | -t | None | Target IP address |
--port | -p | Auto | Wireless Debugging port |
--command | -c | None | Execute single command |
--output | -o | None | Save output to file |
--verbose | -v | False | Enable debug logging |
--interactive | -i | True | Interactive shell mode |
--no-interactive | - | False | Exit after command execution |
--scan | - | False | Scan network for vulnerable devices |
--interface | - | None | Network interface for scanning |
--key-type | - | ec | Certificate type (ec or ed25519) |
--max-retries | - | 3 | Maximum retry attempts |
--no-auto-port | - | False | Disable automatic port discovery |