Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/totekuh/cve-2026-75616
Embedded Systems SecurityIoT SecurityExploitationWeb Application Exploitation
GitHubtotekuh/cve-2026-75616

CVE-2026-75616

Proof-of-concept exploit for authenticated OS command injection in TP-Link Archer C20 v6 web management interface, executing root commands via BPA WAN configuration over LAN.

View Repository
1 day agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-75616

Authenticated OS command injection in the TP-Link Archer C20 v6 web management interface.

BPA WAN configuration values are passed to system() without adequate neutralization, allowing an authenticated administrator on the adjacent network to execute commands as root.

Discovered and reported by Daniil Gordeev (totekuh).

Affected Versions

  • Archer C20 v6 EU firmware earlier than 0.9.1 Build 260811
  • Archer C20 v6 US firmware earlier than 0.9.1 Build 260812
  • Archer C20 v6 RU firmware earlier than 0.9.1 Build 260812

Requirements

  • Administrator credentials
  • Access to the router's LAN web interface
  • WAN connected to a network that provides DHCP
  • Python 3, requests, and pycryptodome

Usage

root@kitploit:~
python3 -m pip install requests pycryptodome
python3 bpa-poc.py --target 192.168.0.1 --password '<admin-password>'
nc 192.168.0.1 4445

Use --list-only to enumerate WAN instances without triggering the command injection.

References

  • TP-Link advisory
  • CVE record
  • NVD record
Download Tool