EIP-2026-104248
PRE-CVEFibaro Home Center 2 - Remote Command Execution / Privilege Escalation
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-104248. PoCs published by forsec.
AI-analyzed exploit summary This exploit leverages a command injection vulnerability in Fibaro's liliSetDeviceCommand.php endpoint to achieve remote code execution (RCE). It crafts a malicious payload that writes a reverse shell script to a tar archive, encodes it in base64, and executes it via sudo update --manual, resulting in a root shell.
Description
Fibaro Home Center 2 - Remote Command Execution / Privilege Escalation
Exploits (1)
This exploit leverages a command injection vulnerability in Fibaro's liliSetDeviceCommand.php endpoint to achieve remote code execution (RCE). It crafts a malicious payload that writes a reverse shell script to a tar archive, encodes it in base64, and executes it via sudo update --manual, resulting in a root shell.