eev4n

GitHub · Repository owner · Source ID 277007622
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

eev4n/CVE-2026-53582

Repository PoC0Created 2026-06-16Not analyzedCVE-2026-535821 file

78 B

GitHubPoC details
GitHub

eev4n/tplink-osci

Repository PoC0Created 2026-04-19ExploitCVE-2023-335382 files

1.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (xp.py) that exploits CVE-2023-33538, a command injection vulnerability in TP-Link routers. It sends a crafted HTTP request to /userRpm/WlanNetworkRpm.htm with a malicious ssid1 parameter containing a shell command, or optionally sends a TDDP packet with the command injected into the SSID field.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (xp.py) that implements a proof-of-concept exploit for CVE-2023-33538, a command injection vulnerability in TP-Link routers. The script sends a crafted payload to the vulnerable endpoint /userRpm/WlanNetworkRpm or via TDDP, executing a user-supplied command. No backdoor, deceptive payload, or concealed operator-directed harm is present. The README.md contains only an image link with no executable content.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareTP-Link TL-WR940NTP-Link TL-WR841NTP-Link TL-WR740N
Attack typescommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload designed to execute arbitrary commands on the target device, which constitutes exploitation rather than mere detection or scanning.

xp.py:19-20xp.py:49-50xp.py:52-56

Requirements

  • Target must be a vulnerable TP-Link router model (TL-WR940N V2/V4, TL-WR841N V8/V10, TL-WR740N V1/V2) with the /userRpm/WlanNetworkRpm endpoint accessible.xp.py:1-66
  • Attacker must provide valid HTTP Basic Authentication credentials (default admin:admin).xp.py:12-13xp.py:48xp.py:55

Observed behavior

  • Constructs a command injection payload by replacing spaces with ${IFS} and embedding the command in the ssid1 parameter.xp.py:19-20xp.py:49-50
  • Sends an HTTP GET request to /userRpm/WlanNetworkRpm.htm with the malicious ssid1 parameter and Basic auth cookie.xp.py:52-56
  • Optionally sends a crafted TDDP UDP packet to port 1040 with the command injected into the SSID field.xp.py:25-36
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the expected behavior for a PoC exploit targeting CVE-2023-33538. The command is user-supplied and not hardcoded to perform malicious actions.xp.py:19-20xp.py:29-30xp.py:49-52
User Controlled Command
Payload withheldThe script does not contain any hardcoded malicious command; the operator controls what is executed on the target.xp.py:14xp.py:19-20
Authentication Handling
Payload withheldThis is standard for accessing the router's web interface and does not indicate credential theft or exfiltration.xp.py:48xp.py:55
Review boundaries

What the analysis did not establish

  • The README.md contains an external image link (https://o.uguu.se/zJMxTaaq.jpg) which was not fetched or analyzed; its content is unknown but is not executable code within the repository.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.