OS Command Injection in Linksys MR9600 JNAP Smart Connect Handler

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-6992 targeting Linksys MR9600 routers with Bluetooth management support. It contains one executable script, CVE-2026-6992-PoC.py, and a README with usage notes. The exploit is an authenticated network/web attack against the router’s JNAP administrative interface. It accepts a target IP/port, optional HTTPS mode, admin credentials, and attacker listener IP/port. The script disables TLS certificate validation so it can talk to routers using self-signed HTTPS certificates. Operational flow: (1) build the target base URL and Basic Authorization header; (2) query the JNAP GetDeviceMode action; (3) if the router is not in Master mode, call SetDeviceMode to switch it; (4) exploit the BTRequestGetSmartConnectPIN JNAP action by injecting shell metacharacters into the JSON 'pin' field; (5) use that injection to write a CGI shell script to /www/ui/1.0.99.206937/static/shell.cgi; (6) invoke the CGI shell over HTTP to verify code execution with 'busybox whoami'; and (7) send a reverse shell command that uses mkfifo and /usr/bin/nc to connect back to the operator. Main exploit capability: authenticated remote command execution as root on the router, followed by reverse shell access. The exploit also leaves behind a web-accessible helper shell at a predictable path, which can be used for subsequent command execution. The code is functional and offensive rather than merely demonstrative, but it uses a hardcoded payload approach rather than a flexible framework, so OPERATIONAL is the best maturity fit.