MeiG Smart Technology - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/meig-smart-technology/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 18:04:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMeiG Smart FORGE_SLT711: Unauthenticated OS command injection (CVE-2026-36356)https://feed.craftedsignal.io/briefs/2026-10-meig-forge-slt711-rce/Thu, 29 Oct 2026 18:04:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-meig-forge-slt711-rce/An unauthenticated OS command injection vulnerability in the MeiG Smart FORGE_SLT711 router allows remote attackers to execute arbitrary commands as root via the /action/SetRemoteAccessCfg endpoint.CVE-2026-36356 is a critical vulnerability in the MeiG Smart FORGE_SLT711 4G LTE CPE router. The custom action handler for the GoAhead web server, specifically the '/action/SetRemoteAccessCfg' endpoint, fails to perform authentication and does not sanitize the 'password' parameter provided in JSON POST requests. This allows an unauthenticated attacker to inject shell commands into a 'system()' call executed with root privileges. Public exploit code is available.

Impact

Successful exploitation allows remote, unauthenticated attackers to gain a full root shell on affected CPE devices. The vulnerability facilitates persistent access, such as the deployment of a telnet backdoor, and full system control.

Recommendation

  • Identify all internet-facing MeiG Smart FORGE_SLT711 devices.
  • Restrict access to the router's web management interface to trusted internal IP ranges or VPN-only access.
  • Coordinate with the vendor or service provider to verify if a firmware patch is available to address the unsafe 'sprintf' and 'system' implementation in the GoAhead handler.
  • Deploy detection rules to monitor for suspicious HTTP POST requests directed at the '/action/SetRemoteAccessCfg' endpoint.
]]>criticaladvisorycve-2026-36356rcecommand-injectionnetwork-device