https://poc.intelseclab.com/tags/iot/Latest proof-of-concept entries.Hugoen-usSat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Critical severity (CVSS 9.8) — network · CVE-2022-26258. Status: Weaponized (public PoC available; listed in CISA KEV). Affects: D-Link DIR-820L wireless router, all hardware revisions. Tags: d-link, dir-820l, router, command-injection, cwe-78, unauthenticated, remote, iot, eol-device, kev.networkCriticald-linkdir-820lroutercommand-injectioncwe-78unauthenticatedremoteioteol-devicekevhttps://poc.intelseclab.com/pocs/hardware/2026-07-06_cve-2025-65856-onvif-camera-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-06_cve-2025-65856-onvif-camera-auth-bypass/Critical severity (CVSS 9.8) — hardware · CVE-2025-65856. Status: Weaponized. Affects: Xiongmai XM530-based IP camera ONVIF service (tested on model XM530_50X50-WG_8M). Tags: xiongmai, xm530, onvif, ip-camera, iot, auth-bypass, access-control, information-disclosure, rtsp, cwe-306, cwe-287, python, bash, curl.hardwareCriticalxiongmaixm530onvifip-cameraiotauth-bypassaccess-controlinformation-disclosurertspcwe-306cwe-287pythonbashcurlhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-34282-thingsboard-ssrf-svg-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-34282-thingsboard-ssrf-svg-upload/Critical severity (CVSS 9.1) — web · CVE-2025-34282. Status: Weaponized. Affects: ThingsBoard IoT Platform (Image Upload Gallery / Widget Library). Tags: thingsboard, ssrf, cwe-918, svg, image-upload, iot, python, widget-library, tenant-admin.webCriticalthingsboardssrfcwe-918svgimage-uploadiotpythonwidget-librarytenant-adminhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Critical severity (CVSS 9.8) — network · CVE-2025-29384. Status: PoC. Affects: Tenda AC9 dual-band wireless router, web management interface (/goform/AdvSetMacMtuWan endpoint). Tags: tenda, ac9, router, stack-buffer-overflow, cwe-121, dos, rce, mips, embedded, iot, python, ruby, metasploit.networkCriticaltendaac9routerstack-buffer-overflowcwe-121dosrcemipsembeddediotpythonrubymetasploithttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-60854. Status: Weaponized. Affects: D-Link AX1500 router firmware (HNAP/DHMAPI web management SOAP interface). Tags: d-link, ax1500, router, command-injection, os-command-injection, hnap, soap, telnetd, cwe-78, iot.networkCriticald-linkax1500routercommand-injectionos-command-injectionhnapsoaptelnetdcwe-78iothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/High severity — network · CVE-2026-1459. Status: PoC. Affects: Zyxel VMG3625-T50B (and similar) router firmware. Tags: zyxel, router, firmware, command-injection, cgi-bin, ssh, authenticated, iot.networkHighzyxelrouterfirmwarecommand-injectioncgi-binsshauthenticatediothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34474-zte-router-sensitive-data-exposure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34474-zte-router-sensitive-data-exposure/High severity — network · CVE-2026-34474. Status: PoC. Affects: ZTE ZXHN H298A (hardware 1.1) and ZXHN H108N (hardware 2.6) home routers. Tags: information-disclosure, router, firmware, unauthenticated, credential-leak, iot, zte, wifi.networkHighinformation-disclosurerouterfirmwareunauthenticatedcredential-leakiotztewifihttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34472-zte-h188a-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34472-zte-h188a-auth-bypass/Critical severity — network · CVE-2026-34472. Status: PoC. Affects: ZTE ZXHN H188A V6 home router firmware. Tags: router, firmware, unauthenticated, auth-bypass, credential-leak, iot, zte, wifi.networkCriticalrouterfirmwareunauthenticatedauth-bypasscredential-leakiotztewifihttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34473-zte-router-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34473-zte-router-dos/High severity — network · CVE-2026-34473. Status: PoC. Affects: ZTE H-series routers (17+ models, reported as affecting 140K+ devices). Tags: router, firmware, unauthenticated, denial-of-service, iot, zte, cgilua, web-interface.networkHighrouterfirmwareunauthenticateddenial-of-serviceiotztecgiluaweb-interfacehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38698-wyze-cam-tutk-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38698-wyze-cam-tutk-heap-overflow/Critical severity — network · CVE-2026-38698. Status: PoC. Affects: TUTK SDK (as used in Wyze Cam Pan v3 and other TUTK-based IoT cameras). Tags: tutk-sdk, iot, camera, heap-overflow, av-server, wyze, authenticated, p2p.networkCriticaltutk-sdkiotcameraheap-overflowav-serverwyzeauthenticatedp2phttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Critical severity — network · CVE-2026-0651 (chained with CVE-2026-0652, CVE-2026-0653). Status: Weaponized. Affects: TP-Link Tapo C260 IP camera (pre-patch firmware, shared /bin/main omnibus binary across models). Tags: iot, ip-camera, tp-link, tapo, path-traversal, command-injection, privilege-escalation, exploit-chain.networkCriticaliotip-cameratp-linktapopath-traversalcommand-injectionprivilege-escalationexploit-chainhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Critical severity — network · CVE-2026-11834. Status: Weaponized. Affects: TP-Link router firmware (libcmm.so DHCP client), tested on Archer C20 V6. Tags: tp-link, router, dhcp, command-injection, cwe-78, race-condition, rce, iot.networkCriticaltp-linkrouterdhcpcommand-injectioncwe-78race-conditionrceiothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8697-tplink-archer-c64-ssh-ratelimit-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8697-tplink-archer-c64-ssh-ratelimit-bypass/Critical severity (CVSS 9.3) — network · CVE-2026-8697. Status: PoC. Affects: TP-Link Archer C64 router firmware ("TPOS"). Tags: tplink, archer-c64, router, ssh, rate-limit-bypass, authentication-oracle, brute-force, iot.networkCriticaltplinkarcher-c64routersshrate-limit-bypassauthentication-oraclebrute-forceiothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/High severity — network · CVE-2026-11499. Status: PoC. Affects: Tenda HG7 / HG9 / HG10 routers (firmware family HG7_HG9_HG10re_300001138_en_xpon and similar). Tags: tenda, router, buffer-overflow, cwe-121, dos, embedded, iot, rce.networkHightendarouterbuffer-overflowcwe-121dosembeddediotrcehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38426-tasmota-fetchjpg-strcpy-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38426-tasmota-fetchjpg-strcpy-overflow/Critical severity (CVSS 9.8) — network · CVE-2026-38426. Status: PoC. Affects: Arendst Tasmota (ESP32 firmware). Tags: tasmota, esp32, iot, buffer-overflow, strcpy, rce, mjpeg, scripter.networkCriticaltasmotaesp32iotbuffer-overflowstrcpyrcemjpegscripterhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38427-tasmota-fetchjpg-integer-wraparound/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38427-tasmota-fetchjpg-integer-wraparound/Critical severity (CVSS 9.8) — network · CVE-2026-38427. Status: PoC. Affects: Arendst Tasmota (ESP32 firmware). Tags: tasmota, esp32, iot, integer-overflow, heap-corruption, rce, mjpeg, scripter.networkCriticaltasmotaesp32iotinteger-overflowheap-corruptionrcemjpegscripterhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38422-tasmota-fetchjpg-combined-overflow-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38422-tasmota-fetchjpg-combined-overflow-rce/Critical severity (CVSS 9.8) — network · CVE-2026-38422. Status: PoC. Affects: Arendst Tasmota (ESP32 firmware). Tags: tasmota, esp32, iot, buffer-overflow, integer-overflow, rce, mjpeg, scripter.networkCriticaltasmotaesp32iotbuffer-overflowinteger-overflowrcemjpegscripterhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39842-openremote-expression-injection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39842-openremote-expression-injection-rce/Critical severity (CVSS 10) — web · CVE-2026-39842 / GHSA-7mqr-33rv-p3mp. Status: Weaponized. Affects: OpenRemote (IoT device/rules management platform). Tags: openremote, iot, nashorn, javascript-injection, rules-engine, rce, authenticated, root.webCriticalopenremoteiotnashornjavascript-injectionrules-enginerceauthenticatedroothttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6992-mr9600-router-bluetooth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6992-mr9600-router-bluetooth-rce/High severity — network · CVE-2026-6992. Status: PoC. Affects: MR9600 router (Bluetooth-capable administrative interface). Tags: router, bluetooth, jnap, command-injection, iot, rce.networkHighrouterbluetoothjnapcommand-injectioniotrcehttps://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-12485-geovision-dvrsearch-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-12485-geovision-dvrsearch-rce/Critical severity (CVSS 10) — network · CVE-2026-12485. Status: PoC. Affects: GeoVision GV-I/O Box 4E (Linux-based smart embedded I/O device). Tags: RCE, unauthenticated, stack-overflow, buffer-overflow, IoT, GeoVision, DVR, embedded, UDP, network, Python, CVSS-10.networkCriticalRCEunauthenticatedstack-overflowbuffer-overflowIoTGeoVisionDVRembeddedUDPnetworkPythonCVSS-10