CVE-2020-26878

This repository contains a functional exploit for CVE-2020-26878, demonstrating a command injection vulnerability in the user creation endpoint of an unspecified service. The exploit uses a crafted JSON payload to execute arbitrary commands, including user creation and privilege escalation via sudoers modification.

This PoC exploits a command injection vulnerability in Ruckus IoT Controller (vRIoT) versions <= 1.5.1.0.21, leveraging broken authentication to achieve remote code execution via a crafted payload in the username field.

This repository contains a functional exploit for CVE-2020-26878, targeting Ruckus IoT Controller (Ruckus vRIoT) versions <= 1.5.1.0.21. The exploit leverages command injection and broken authentication to achieve remote code execution (RCE) as root.