Unauthenticated RCE in Motorola MR2600 via firmware upload flaw
Researcher discovered that the MR2600’s firmware upload endpoint fails to enforce authentication before writing arbitrary data, allowing an unauthenticated attacker to craft a raw firmware image and trigger remote code execution. The bug bypasses multipart validation and persists even after the auth check, exposing any LAN‑connected device to full takeover.