MIPS-Based Managed Switch Firmware Pre-Auth Kernel RCE — CVE-2026-1668

Metadata

Affected Target

Summary

The switch’s embedded web management HTTP server contains a memory-corruption flaw reachable via a crafted request to the /data/login.json endpoint, exploitable before the device’s first legitimate HTTP request after boot. The PoC builds a raw MIPS shellcode payload (position-independent, using a custom linker script and freestanding C/assembly stub) that is appended after crafted HTTP headers with an oversized Content-Length value, triggering the vulnerable code path in the kernel/HTTP server. Successful exploitation spawns a reverse shell back to the attacker, granting root access to the switch’s underlying embedded Linux system. The author has published a companion blog series explaining the memory-corruption primitive and payload construction in detail.

Vulnerability Details

Root Cause

A memory-corruption bug in the switch firmware’s HTTP request handling for /data/login.json (root cause detailed in the author’s blog series) is triggered by a malformed request with an oversized Content-Length header, allowing injected MIPS shellcode to hijack execution during a very early boot-time window before the server has processed its first legitimate request.

Attack Vector

1. Attacker builds the raw shellcode payload (payload.s + shell.c + linux.h, linked via ldscript) using a MIPS Linux GCC cross-toolchain (make).
2. Attacker starts a listener and, immediately after the switch boots (before its first legitimate HTTP request), sends the crafted http-request.bin (headers from http-headers.txt concatenated with the compiled shellcode) to TCP port 80 on the switch.
3. The malformed request with an oversized Content-Length triggers the memory-corruption path, executing the embedded shellcode.
4. The shellcode connects back to the attacker’s listener on TCP port 8888.
5. Attacker receives an interactive root shell on the switch’s embedded Linux OS.

Impact

Full unauthenticated remote code execution as root on the affected managed switch, granting complete control over network switching infrastructure.

Environment / Lab Setup

Target:   Affected MIPS-based managed switch, freshly booted (pre-first-request window), management HTTP server on port 80
Attacker: mips-linux-gnu-gcc / mips-linux-gnu-objcopy (e.g. `apt install gcc-mips-linux-gnu` on Ubuntu 24.04), make, nc (netcat), bash

Proof of Concept

PoC Script

See Makefile, payload.s, shell.c, linux.h, ldscript, http-headers.txt, and run.sh in this folder.

1
2

make        # cross-compiles payload.s/shell.c into http-request.bin
./run.sh    # sends the payload to 192.168.0.1 and connects back for a shell

make builds the raw MIPS shellcode and concatenates it with the crafted HTTP headers into http-request.bin; run.sh then sends that request to the switch’s management IP over port 80 and opens a listener on port 8888 to catch the resulting root reverse shell — this must be run against a freshly booted device before it serves its first real HTTP request.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected root shell/reverse-connection processes running on the switch’s embedded OS
• Switch management HTTP server crashing or restarting shortly after boot
• Outbound connections from the switch to non-management infrastructure

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/tangrs/cve-2026-1668-poc on 2026-07-05.