CVE-2026-36356

CRITICAL

MeiG Smart FORGE_SLT711 GoAhead /action/SetRemoteAccessCfg Unauthenticated OS Command Injection

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-36356 has a selected CVSS score of 9.1 (critical); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 21, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Smart FORGE_SLT711

Browse MeiG / Smart FORGE_SLT711
VulnCheckVersion data not supplied

Proofs of concept

2

Catalogued exploits

ExploitDBMeiG Smart FORGE_SLT711 - OS Command InjectionExploitDB exploitby Daniil GordeevExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends a crafted HTTP POST request to the /action/SetRemoteAccessCfg endpoint of a MeiG Smart FORGE_SLT711 device to achieve unauthenticated remote command execution as root via OS command injection in the password field.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a straightforward proof-of-concept exploit for CVE-2026-36356. It sends a user-supplied command via a JSON payload to a vulnerable endpoint on a target device. The script contains no hidden or deceptive functionality, no persistence mechanisms, no data exfiltration to unrelated parties, and no obfuscated payloads. All actions are directly related to the described OS command injection vulnerability.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareGoAhead web server
Attack typescommand_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload to a vulnerable endpoint to execute arbitrary OS commands on the target, which constitutes exploitation rather than mere detection or analysis.

exploits/linux/hardware/52581.py:28-54

Requirements

  • Target must be a MeiG Smart FORGE_SLT711 device with vulnerable GoAhead web server accessible over the network.exploits/linux/hardware/52581.py:1

Observed behavior

  • Sends a POST request to /action/SetRemoteAccessCfg with a JSON body containing a password field with a command injection payload.exploits/linux/hardware/52581.py:29-37
  • Injects an arbitrary OS command via the password field using command substitution syntax $(cmd).exploits/linux/hardware/52581.py:30
  • Checks HTTP response for retcode 0 to confirm command execution.exploits/linux/hardware/52581.py:43-44
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
Payload withheldThe script constructs a JSON payload where the user-provided command is embedded within a shell command substitution, which is the core of the documented exploit.exploits/linux/hardware/52581.py:30
Network Request
Payload withheldThe script sends the malicious payload to the vulnerable endpoint on the target device, consistent with the CVE description.exploits/linux/hardware/52581.py:29
Review boundaries

What the analysis did not establish

  • Review is limited to the single provided Python file; no external libraries, dependencies, or referenced resources were analyzed.
  • The script's behavior depends on the user-supplied '--cmd' argument; the review does not assess the safety of any command a user might choose to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubtotekuh/CVE-2026-36356Repository PoCby totekuh0Exploit5 files

113.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (poc_rce.py) that sends a crafted HTTP POST request to the vulnerable /action/SetRemoteAccessCfg endpoint to execute arbitrary OS commands on a target device. The script constructs a JSON payload with a command injection in the 'password' field and sends it without authentication, exercising the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md vulnerability advisory and a poc_rce.py exploit script for CVE-2026-36356. The README describes an unauthenticated OS command injection in a GoAhead web server on a specific IoT device, and the Python script implements a proof-of-concept exploit that sends a crafted HTTP request to the vulnerable endpoint. The script's behavior is entirely consistent with the described vulnerability: it takes a user-supplied command, wraps it in a shell substitution, and sends it to the target. No concealed executable behavior, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit is present. The code is straightforward and unobfuscated.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareGoAhead web serverMeiG Smart FORGE_SLT711 firmware
Attack typesOS command injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file poc_rce.py is a functional script that actively exploits the CVE-2026-36356 vulnerability by sending a malicious HTTP request to execute arbitrary commands on a target system. It is not merely a scanner or a writeup; it is code intended to exercise the vulnerability.

poc_rce.py:1-76README.md:60-69

Requirements

  • Target device must be a MeiG Smart FORGE_SLT711 with vulnerable firmware (e.g., MDM9607.LE.1.0-00110-STD.PROD-1) running the GoAhead web server.README.md:10README.md:18
  • Network access to the target device's HTTP service (default port 80).poc_rce.py:30

Observed behavior

  • Sends an unauthenticated HTTP POST request to /action/SetRemoteAccessCfg with a JSON body containing a command injection payload in the 'password' field.poc_rce.py:30-38
  • Checks the HTTP response for a 'retcode' of 0 to confirm command execution.poc_rce.py:40-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldThis is the intended PoC behavior for CVE-2026-36356, not a backdoor.poc_rce.py:31poc_rce.py:64
Network Connection
Payload withheldThis is the delivery mechanism for the exploit, not a backdoor.poc_rce.py:30poc_rce.py:33-38
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the binary firmware or the GoAhead binary; the decompiled handler code is only described in the README.
  • The packet indicates complete_artifact_coverage is false, and two text files are omitted from the content, though the primary exploit code and README are fully included.
  • One non-text media file (rce-demo.png) was present in the repository but not analyzed; it is a screenshot referenced in the README.
  • Two additional text files (route.txt and a firmware binary) were present in the repository but their content was not included in the evidence packet; they are described in the README as supporting the vulnerability analysis.
  • The review is limited to the supplied evidence and does not assess the safety of executing the PoC against a real device.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4