RhestCorp

GitHub · Repository owner · Source ID 270709056
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

RhestCorp/TP-L-NK-SIZMA-EXPLO-T

Repository PoC1Created 2026-04-03ExploitCVE-2022-300753 files

15.4 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2022-30075 targeting TP-Link Archer AX50 routers. It authenticates, downloads the encrypted configuration backup, decrypts it using a hardcoded AES key, injects a command into the DDNS configuration, re-encrypts the backup, and restores it to achieve authenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2022-30075. The script performs authenticated remote code execution on TP-Link routers by downloading, decrypting, modifying, re-encrypting, and restoring a configuration backup. The injected command defaults to starting a telnet daemon. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality was observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareTP-Link Archer AX50 Router Firmware
Attack typesAuthenticated Remote Code ExecutionCommand Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Python script that performs all steps required to exploit CVE-2022-30075: authentication, configuration download, decryption, command injection, re-encryption, and restoration. It is designed to execute arbitrary commands on the target, not merely detect the vulnerability.

tplink.py:1-287README.md:1-2

Requirements

  • Valid administrator password for the target TP-Link router.tplink.py:16-18
  • Network access to the router's web interface.tplink.py:65

Observed behavior

  • Authenticates to the router using the provided password.tplink.py:99-106
  • Downloads the encrypted configuration backup file from the router.tplink.py:254-255
  • Decrypts the configuration backup using a hardcoded AES key and IV.tplink.py:116-117tplink.py:167-202
  • Injects a user-supplied command into the DDNS service configuration within the decrypted XML.tplink.py:205-238
  • Re-encrypts the modified configuration and uploads it to the router to trigger a restore and reboot.tplink.py:275-280
  • Instructs the user to connect via telnet to the router after reboot to obtain a root shell.tplink.py:287
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Default Command
Payload withheldThe default command injected into the router configuration starts a telnet daemon, which is consistent with the stated purpose of gaining root shell access.tplink.py:247
Hardcoded Key
Payload withheldA hardcoded AES key is used to decrypt and re-encrypt the router configuration backup. This is necessary for the exploit to function and is not indicative of a backdoor.tplink.py:116
Author Attribution
Payload withheldThe script prints an author/team name at startup. This is a common practice in proof-of-concept exploits and does not constitute malicious behavior.tplink.py:12
Review boundaries

What the analysis did not establish

  • One file (total 3) was omitted from the packet due to content selection rules, but the two included text files (README.md and tplink.py) provide complete coverage of the exploit logic.
  • One file in the repository (metadata only) was not included in the text analysis; its content is unknown.
  • The review is limited to static analysis of the provided source code; no dynamic or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.