Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-20452. PoCs published by hacefresko, Hunt-Benito.
AI-analyzed exploit summary This exploit targets a heap overflow vulnerability in a UPnP service (WFAWLANConfig) on port 49152, leveraging a crafted SOAP request to achieve remote code execution (RCE) via shellcode injection. The payload modifies the root password in `/data/zcfg_config.json` and attempts SSH login with the new credentials.
Description
In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00480138; Issue ID: MSV-6295.
Exploits (2)
This exploit targets a heap overflow vulnerability in a UPnP service (WFAWLANConfig) on port 49152, leveraging a crafted SOAP request to achieve remote code execution (RCE) via shellcode injection. The payload modifies the root password in `/data/zcfg_config.json` and attempts SSH login with the new credentials.
This repository contains a functional proof-of-concept exploit for CVE-2026-20452, a heap-based buffer overflow in MediaTek's WLAN Access Point driver. The exploit crafts malformed 802.11 data frames with oversized Information Elements to trigger the vulnerability.
References (1)
Scores
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H