MeiG Smart FORGE_SLT711 - OS Command Injection

ExploitDBExploitDB exploitExploitEDB-52581

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends a crafted HTTP POST request to the /action/SetRemoteAccessCfg endpoint of a MeiG Smart FORGE_SLT711 device to achieve unauthenticated remote command execution as root via OS command injection in the password field.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a straightforward proof-of-concept exploit for CVE-2026-36356. It sends a user-supplied command via a JSON payload to a vulnerable endpoint on a target device. The script contains no hidden or deceptive functionality, no persistence mechanisms, no data exfiltration to unrelated parties, and no obfuscated payloads. All actions are directly related to the described OS command injection vulnerability.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareGoAhead web server
Attack typescommand_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload to a vulnerable endpoint to execute arbitrary OS commands on the target, which constitutes exploitation rather than mere detection or analysis.

exploits/linux/hardware/52581.py:28-54

Requirements

  • Target must be a MeiG Smart FORGE_SLT711 device with vulnerable GoAhead web server accessible over the network.exploits/linux/hardware/52581.py:1

Observed behavior

  • Sends a POST request to /action/SetRemoteAccessCfg with a JSON body containing a password field with a command injection payload.exploits/linux/hardware/52581.py:29-37
  • Injects an arbitrary OS command via the password field using command substitution syntax $(cmd).exploits/linux/hardware/52581.py:30
  • Checks HTTP response for retcode 0 to confirm command execution.exploits/linux/hardware/52581.py:43-44
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
$({cmd})The script constructs a JSON payload where the user-provided command is embedded within a shell command substitution, which is the core of the documented exploit.exploits/linux/hardware/52581.py:30
Network Request
POST http://{ip}:{port}/action/SetRemoteAccessCfgThe script sends the malicious payload to the vulnerable endpoint on the target device, consistent with the CVE description.exploits/linux/hardware/52581.py:29
Review boundaries

What the analysis did not establish

  • Review is limited to the single provided Python file; no external libraries, dependencies, or referenced resources were analyzed.
  • The script's behavior depends on the user-supplied '--cmd' argument; the review does not assess the safety of any command a user might choose to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1