CVE-2022-48194

This exploit constructs a malicious firmware image for TP-Link TL-WR902AC by embedding a backdoor (netcat reverse shell) into the firmware's init scripts, then uploads it to the device via authenticated HTTP requests. It leverages AES and RSA encryption for session handling and firmware signing.

This PoC exploits CVE-2022-48194, a firmware update vulnerability in TP-Link TL-WR902AC routers, allowing authenticated attackers to execute arbitrary code via a crafted firmware update. The exploit automates the process of downloading, modifying, and uploading malicious firmware to achieve RCE.