Unauthenticated RCE in Motorola's MR2600 Router

Two backwards authentication checks let anyone on the network overwrite a Motorola router's firmware without a password.

Security researcher MrBruh has disclosed an unauthenticated remote code execution flaw in Motorola's MR2600, a Wi-Fi 5 router whose final firmware update (v1.0.22) shipped in mid-2024. The exploit chains two broken authentication checks: attackers first push a malicious image to the fwupload.cgi endpoint, where the login check runs only after the file is already written to /tmp/firmware.img and never deletes it on failure, then trigger the LoadFirmwareValidation SOAP routine to flash it. That second check is bypassed by appending an allowlisted string such as ?Login.html to the /WEBCGI1/ path, exploiting code that matches allowed endpoints by substring but blocks the denylisted path only on an exact match. Because Motorola's images require no cryptographic signing, anyone can craft a valid firmware that the router accepts and writes via mtd_write before rebooting.