Sadık Ertürk

ExploitDB · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

ExploitDB

ePati Antikor NGFW 2.0.1301 - Authentication Bypass

ExploitDB exploitPublished 2026-05-14ExploitCVE-2026-26241 file

EDB-52562

ExploitDBPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to an ePati Antikor NGFW WebSocket endpoint without authentication and sends commands to leak cluster status and network packet data.

Backdoor review

No backdoor observed in reviewed code

The PoC script connects to a target WebSocket, sends two JSON payloads to trigger the reported authentication bypass (CVE-2026-2624), and prints the responses. No backdoor, concealed executable behavior, or operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareePati Antikor Next Generation Firewall (NGFW)
Attack typesAuthentication BypassInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively connects to a target, sends commands that extract sensitive data (cluster status and network packets), and prints the results. This constitutes exploitation, not mere detection or scanning.

exploits/multiple/webapps/52562.txt:1exploits/multiple/webapps/52562.txt:29-70

Requirements

  • Target ePati Antikor NGFW instance running a vulnerable version (v.2.0.1298 to v.2.0.1301) with WebSocket service accessible on the specified port (default 8800).exploits/multiple/webapps/52562.txt:6-7exploits/multiple/webapps/52562.txt:34exploits/multiple/webapps/52562.txt:86

Observed behavior

  • Generates random server and session IDs to construct a SockJS WebSocket URL.exploits/multiple/webapps/52562.txt:30-34
  • Connects to the target WebSocket server without providing any authentication credentials, bypassing SSL certificate validation.exploits/multiple/webapps/52562.txt:39-41
  • Sends a JSON command 'rapor-dinle' with parameter 'cluster-durum' to listen to cluster status.exploits/multiple/webapps/52562.txt:45-47
  • Receives and prints the server response containing sensitive system data.exploits/multiple/webapps/52562.txt:51-55
  • Sends a second JSON command 'paket-liste-dinle' to listen to network packet data.exploits/multiple/webapps/52562.txt:58-60
  • Receives and prints the server response containing captured network packet data.exploits/multiple/webapps/52562.txt:63-67
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe script connects to a user-supplied target to demonstrate the authentication bypass vulnerability.exploits/multiple/webapps/52562.txt:34-41
Payload
Payload withheldFirst payload sent to the target to listen to cluster status, consistent with the described vulnerability.exploits/multiple/webapps/52562.txt:45-47
Payload
Payload withheldSecond payload sent to the target to listen to network packets, consistent with the described vulnerability.exploits/multiple/webapps/52562.txt:58-60
Review boundaries

What the analysis did not establish

  • Only the single text file 52562.txt was analyzed; no external dependencies or referenced resources were inspected.
  • The code was not executed; classification is based solely on static analysis of the provided source.
  • Only the supplied text file was reviewed; no external dependencies (e.g., websocket library) were inspected.
  • The script's behavior depends on the target server's response, which is not controlled by the PoC.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.