Unauthenticated OS Command Injection in TP-Link Archer Parental Control

This repository is a small standalone Python exploit for CVE-2026-9254 affecting the TP-Link Archer BE800 V1 parental control functionality. The repository contains 3 files: a single Python exploit script, a README describing the vulnerability and affected version, and a license. The exploit is not part of a larger framework. The main file, CVE-2026-9254.py, implements an interactive LAN-side RCE exploit against the router’s /cgi-bin/luci/blocking?form=vercode endpoint. It first abuses an information disclosure issue to read the current vercode without authentication using the token and MAC values obtained from the captive portal redirect URL. It then sends a POST request where the url parameter contains a newline injection payload. That payload causes the router to execute attacker-controlled shell commands as root. Operationally, the exploit uses a two-stage design. Stage 1 injects commands that make the router fetch a shell script from the attacker’s temporary HTTP server using wget and save it as /tmp/s.sh. Stage 2 executes that script, which runs an operator-supplied command and pipes the output to nc, sending results back to the attacker’s TCP listener. This avoids the target’s deny-list restrictions while providing an interactive shell-like loop. Capabilities include unauthenticated vercode retrieval, arbitrary command execution as root, hosting a transient HTTP payload server, and receiving command output over a callback socket. The exploit requires LAN adjacency and a reachable attacker host on the same network, but no admin credentials. Based on the included payloading and interactive command loop, this is an operational exploit rather than a simple detection script or bare proof of concept.