EIP-2026-101494

This exploit leverages a file inclusion vulnerability in the WD TV Live Streaming Media Player's web interface, combined with arbitrary file upload via theme customization, to execute a root shell. The PoC uploads a malicious PHP file via a zip archive and triggers its execution through a crafted cookie.