Skip to content
Threat Feed
Subscribe
critical advisory

MeiG Smart FORGE_SLT711: Unauthenticated OS command injection (CVE-2026-36356)

An unauthenticated OS command injection vulnerability in the MeiG Smart FORGE_SLT711 router allows remote attackers to execute arbitrary commands as root via the /action/SetRemoteAccessCfg endpoint.

CVE search metadata

CVE search record: CVE-2026-36356. Severity: critical. CVSS: 9.1. EPSS: 20.35%. KEV: no. Product: FORGE_SLT711 (firmware MDM9607.LE.1.0-00110-STD.PROD-1). Brief: MeiG Smart FORGE_SLT711: Unauthenticated OS command injection (CVE-2026-36356). Brief link: https://feed.craftedsignal.io/briefs/2026-10-meig-forge-slt711-rce/

Triage facts

Revision 1
Applicability
FORGE_SLT711 (firmware MDM9607.LE.1.0-00110-STD.PROD-1)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 29, 18:04 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Likely

CVE-2026-36356 is a critical vulnerability in the MeiG Smart FORGE_SLT711 4G LTE CPE router. The custom action handler for the GoAhead web server, specifically the '/action/SetRemoteAccessCfg' endpoint, fails to perform authentication and does not sanitize the 'password' parameter provided in JSON POST requests. This allows an unauthenticated attacker to inject shell commands into a 'system()' call executed with root privileges. Public exploit code is available.

Impact

Successful exploitation allows remote, unauthenticated attackers to gain a full root shell on affected CPE devices. The vulnerability facilitates persistent access, such as the deployment of a telnet backdoor, and full system control.

Recommendation

  • Identify all internet-facing MeiG Smart FORGE_SLT711 devices.
  • Restrict access to the router's web management interface to trusted internal IP ranges or VPN-only access.
  • Coordinate with the vendor or service provider to verify if a firmware patch is available to address the unsafe 'sprintf' and 'system' implementation in the GoAhead handler.
  • Deploy detection rules to monitor for suspicious HTTP POST requests directed at the '/action/SetRemoteAccessCfg' endpoint.

Immediate actions

Configure WAF or ingress firewall rules to block traffic to /action/SetRemoteAccessCfg from untrusted networks.

SOC 24h

Threat Hunt

Hunt for inbound POST requests to /action/SetRemoteAccessCfg.

T1190 high high confidence convert to detection

Data: Web server access logs

Mitigations

Disable remote access to the management interface on all affected FORGE_SLT711 devices.

immediate IT Operations

CVE-2026-36356

Detection coverage 1

Detect CVE-2026-36356 Exploitation - Unauthenticated RCE via SetRemoteAccessCfg

critical

Detects exploitation attempts against CVE-2026-36356 by identifying HTTP POST requests to the /action/SetRemoteAccessCfg endpoint containing shell metacharacters.

sigma tactics: execution, initial_access techniques: T1059.004, T1190 sources: webserver

Detection queries are available on the platform. Get full rules →