Unauthenticated RCE/DoS in Omada Switch Web Interface

This 10-file standalone proof-of-concept targets CVE-2026-1668 in TP-Link managed-switch firmware built for MIPS. It is not associated with an exploit framework. The Makefile cross-compiles payload.s and shell.c as a freestanding MIPS binary and concatenates it with http-headers.txt into http-request.bin. The HTTP request targets POST /data/login.json with a maximal unsigned Content-Length value (4294967295). The assembly payload contains fixed allocator, connection-state, handler, and memory addresses, making it firmware-layout-specific; the supplied README identifies a tested firmware SHA-256 and multiple matching SG/SL firmware images. shell.c implements the post-exploitation capability: it binds TCP/8888, accepts a connection, redirects standard streams, and launches /bin/sh -i. run.sh hard-codes 192.168.0.1 as the default switch address, primes TCP/80, sends the constructed request, then connects to port 8888. The exploit is operational but has a basic hard-coded payload and target memory layout.

This repository is a standalone proof-of-concept exploit for CVE-2026-1668 targeting vulnerable TP-Link smart switch firmware images running on MIPS Linux. It is not a detection tool and not part of a larger exploitation framework. The repository contains a build chain that compiles a custom MIPS payload from payload.s and shell.c using a custom linker script, converts it to raw binary, and prepends crafted HTTP headers to form a malicious request file named http-request.bin. The exploit structure is simple and purpose-built: http-headers.txt defines a POST request to /data/login.json with Content-Length set to 4294967295, indicating an oversized or malformed request intended to corrupt or manipulate the target HTTP server. payload.s lays out carefully crafted memory structures and metadata at fixed addresses, suggesting the exploit depends on precise heap or allocator state and likely abuses an early-boot memory layout condition. shell.c provides the post-exploitation payload: it creates a TCP socket, binds to port 8888 on the target, listens for an incoming connection, duplicates the accepted socket onto stdin/stdout/stderr, and repeatedly execves /bin/sh -i, yielding an interactive bind shell. The helper script run.sh operationalizes the attack by targeting 192.168.0.1, first opening a connection to TCP/80, then sending the malicious HTTP request, and finally connecting to TCP/8888 to obtain the shell. The README explicitly states the exploit must be run before the HTTP server has served its first request after boot, which is a critical exploitation prerequisite. Overall, the repository is a real exploit POC with an operational hardcoded payload that provides remote root shell access on affected devices.