Technical report and authenticated reverse-shell PoC for CVE-2026-96515, a root command execution flaw in the Netlink HG323RW router's BOA diagnostic import handler.
An authenticated limited web user can upload a shell script through the Netlink HG323RW diagnostic import handler and have the UID-0 BOA process execute it. Authentication and valid verification/CSRF values are required; this repository does not claim pre-authentication code execution.
| Field | Value |
|---|---|
| CVE | CVE-2026-96515 |
| Product | Netlink ICT HG323RW Router |
| Affected hardware | V3.7 |
| Affected firmware | 3.1.02-260228 (Netlinkver) |
| Component | bin/boa |
| Endpoint | /boaform/formImportOMCIShell |
| Required access | Authenticated limited web account on the adjacent/private network |
| Demonstrated impact | Uploaded shell content executes as UID 0 |
| CWE | CWE-862 (Missing Authorization), CWE-434 (Unrestricted Upload of File with Dangerous Type) |
| CVSS | 8.6 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Fixed firmware | 3.1.02-260904 (reported by CERT-In and independently inspected; runtime verification confirmed that /boaform/formImportOMCIShell and /boaform/admin/formImportOMCIShell both return HTTP 404) |
| Reporter | Muhammed Safvan |
CERT-In published the record on 24 September 2026 as advisory CIVN-2026-0473. Netlink lists firmware downloads on its firmware page.
The factory-default limited account is provisioned in /etc/config_default.xml, and BOA creates /var/boaUser.passwd from the configured MIB values during startup. After authenticating as the limited user, a request can submit a multipart field named binary to formImportOMCIShell. Evidence from the assessed bin/boa identifies the destination /tmp/omcishell and the execution sink /bin/sh /tmp/omcishell.
The supplied authorized-device transcript records a shell with zero-valued real, effective, saved-set, and filesystem UIDs/GIDs. The exact C source and release history were not available, so affected-version claims are intentionally limited to the assessed image. Both the assessed archive and the CNA-listed patched archive are preserved under firmware/; their structure, embedded versions, and checksums were verified, but the exploit regression was not rerun during this packaging step.
Read REPORT.md for the complete analysis, prerequisites, evidence limitations, and remediation guidance.
REPORT.md — self-contained technical report.poc/ — authenticated private-LAN reverse-shell PoC and usage notes.analysis/ — sanitized static-analysis notes for account provisioning, routing, and role behavior.binary/ — narrow BOA identification, strings, and hash evidence extracted from the assessed image.firmware/ — complete vulnerable and patched vendor firmware archives, hashes, and upgrade warnings.runtime/ — sanitized firmware metadata and supplied runtime-proof provenance.hashes/ — source-artifact digests and verification results.MANIFEST-SHA256.txt — digest of every other tracked repository file.The two complete firmware archives are distributed without extracted working trees. No active session, CSRF token, device identifier, customer data, separately exported encoded password, or non-public credential is included. The factory-default credential pair is discussed because it is material to the affected configuration. Firmware redistribution and use remain subject to the vendor's terms.
The public PoC uploads a fixed FIFO-based reverse-shell payload and provides an interactive listener, so commands entered after connection execute on the router. It refuses public target and callback addresses, prompts for the password by default, and requires an explicit EXECUTE confirmation unless the operator supplies the documented automation override. It was syntax-checked but was not executed during this repository update. Use it only on a device you own or are explicitly authorized to test.
An owner-supplied demo video was retained outside this public repository because it displays an author-machine-specific local path and desktop context. The repository now includes the corresponding reverse-shell PoC source; the recording's hash and a conservative observation summary are preserved in runtime/video-observation.txt.