Root — PoC Archivehttps://poc.intelseclab.com/tags/root/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Realtek rtl819x Jungle SDK Unauthenticated Kernel Memory R/W via Debug IOCTLs (CVE-2026-36355)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36355-realtek-rtl819x-kernel-memory-rw/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36355-realtek-rtl819x-kernel-memory-rw/Critical severity — network · CVE-2026-36355. Status: Weaponized. Affects: Realtek rtl819x "Jungle SDK" out-of-tree Wi-Fi driver (rtl8192cd). Tags: realtek, rtl819x, router-firmware, kernel-memory, ioctl, wifi-driver, root, cwe-782, cwe-787, cwe-200.networkCriticalrealtekrtl819xrouter-firmwarekernel-memoryioctlwifi-driverrootcwe-782cwe-787cwe-200OpenRemote — Expression Injection RCE in Rules Engine (CVE-2026-39842)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39842-openremote-expression-injection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39842-openremote-expression-injection-rce/Critical severity (CVSS 10) — web · CVE-2026-39842 / GHSA-7mqr-33rv-p3mp. Status: Weaponized. Affects: OpenRemote (IoT device/rules management platform). Tags: openremote, iot, nashorn, javascript-injection, rules-engine, rce, authenticated, root.webCriticalopenremoteiotnashornjavascript-injectionrules-enginerceauthenticatedrootOpenLearnX Unauthenticated RCE via Container Volume Mount (CVE-2026-41900)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-41900-openlearnx-container-volume-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-41900-openlearnx-container-volume-rce/High severity (CVSS 8.6) — cloud · CVE-2026-41900 (GHSA-8h25-q488-4hxw). Status: PoC. Affects: OpenLearnX code-execution/compiler service (Flask backend). Tags: docker, container-escape, rce, unauthenticated, code-execution-sandbox, info-disclosure, volume-mount, root.cloudHighdockercontainer-escaperceunauthenticatedcode-execution-sandboxinfo-disclosurevolume-mountrootMeiG Smart FORGE_SLT711 GoAhead Unauthenticated OS Command Injection (CVE-2026-36356)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36356-meig-smart-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36356-meig-smart-router-command-injection/Critical severity — network · CVE-2026-36356. Status: Weaponized. Affects: MeiG Smart FORGE_SLT711 4G LTE CPE (GoAhead web server). Tags: meig-smart, 4g-lte-cpe, router, command-injection, goahead, unauthenticated, root, cwe-78, cwe-306.networkCriticalmeig-smart4g-lte-cperoutercommand-injectiongoaheadunauthenticatedrootcwe-78cwe-306Cisco Catalyst SD-WAN Manager Privilege Escalation (CVE-2026-20245)https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/High severity (CVSS 7.8) — network · CVE-2026-20245. Status: PoC. Affects: Cisco Catalyst SD-WAN Manager (vManage), SD-WAN Controller (vSmart), SD-WAN Validator (vBond). Tags: privilege-escalation, Cisco, SD-WAN, vManage, file-upload, command-injection, root, CISA-KEV, no-patch, Mandiant, nation-state.networkHighprivilege-escalationCiscoSD-WANvManagefile-uploadcommand-injectionrootCISA-KEVno-patchMandiantnation-stateTossUp — TerraMaster TOS Unauthenticated Redis Root RCE + NFS LPEhttps://poc.intelseclab.com/pocs/network/2026-05-18_tossup-terramaster-redis-rce/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-18_tossup-terramaster-redis-rce/Critical severity — network · N/A (vendor confirmed TOS4 is EOL; no fix planned). Status: Weaponized. Affects: TerraMaster TOS3_A1.0 4.2.41, Redis 4.0.10. Tags: RCE, unauthenticated, Redis, TerraMaster, NAS, AArch64, root, module-loading, replication-abuse, NFS, no_root_squash, LPE, network.networkCriticalRCEunauthenticatedRedisTerraMasterNASAArch64rootmodule-loadingreplication-abuseNFSno_root_squashLPEnetwork