CVE-2022-36553 PoC — Hytec Inter HWL-2511-SS 命令注入漏洞

Source

https://github.com/0xNslabs/CVE-2022-36553-PoC

Associated Vulnerability

Title: Hytec Inter HWL-2511-SS 命令注入漏洞 (CVE-2022-36553)
Description:Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.

Description

PoC Script for CVE-2022-36553: Exploits an unauthenticated remote command injection vulnerability in Hytec Inter HWL-2511-SS device.

Readme

# CVE-2022-36553 -  Hytec Inter HWL-2511-SS Unauthenticated Remote Command Injection.

## Overview
This repository contains a Proof of Concept (PoC) reverse shell script for exploiting CVE-2022-36553, a critical vulnerability in Hytec Inter HWL-2511-SS devices. The script is a practical demonstration, complementing the in-depth analysis provided in my blog post "Hytec Inter HWL-2511-SS - Vulnerability Report."

### Affected versions
All Hytec Inter HWL-2511-SS devices from version 1.05 and under.

### PoC Script Usage

```python
# Usage: python HWL-2511-SS.py --RHOST <Target-IP> --RPORT <Target-Port> --LHOST <Local-IP> --LPORT <Local-Port>
# Example: python HWL-2511-SS.py --RHOST 192.168.1.1 --RPORT 443 --LHOST 192.168.1.100 --LPORT 4444
```

 ### Video Proof of Concept

![Script PoC CVE-2022-26134](https://neroteam.com/blog/pages/hytec-inter-hwl-2511-ss-vulnerability-report/hytec-1.jpg?m=1673083022)

[![Hytec Inter HWL-2511-SS Unauthenticated Remote Command Injection](https://i.ibb.co/7gXHL9q/500px-youtube-social-play.png)](https://youtu.be/ILBJglgD-9U)

### Note
FOR EDUCATIONAL PURPOSE ONLY.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →