EIP-2026-104248

This exploit leverages a command injection vulnerability in Fibaro's liliSetDeviceCommand.php endpoint to achieve remote code execution (RCE). It crafts a malicious payload that writes a reverse shell script to a tar archive, encodes it in base64, and executes it via sudo update --manual, resulting in a root shell.