CVE-2025-12478: BLU-IC2/IC4非合规TLS配置漏洞

import socket import ssl import sys def check_tls_vulnerability(host, port=443): """ PoC for CVE-2025-12478: Non-Compliant TLS Configuration This script checks for weak TLS configuration vulnerabilities """ print(f'[*] Checking TLS configuration for {host}:{port}') # Check for TLS 1.0/1.1 support (deprecated) protocols = [ ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.TLSv1_2, ssl.TLSVersion.TLSv1_3 ] weak_protocols = [] for protocol in protocols: try: context = ssl.SSLContext(ssl.TLSVersion.TLSv1_2 if protocol != ssl.TLSVersion.TLSv1_3 else ssl.TLSVersion.TLSv1_3) context.minimum_version = protocol context.maximum_version = protocol with socket.create_connection((host, port), timeout=10) as sock: with context.wrap_socket(sock, server_hostname=host) as ssock: cipher = ssock.cipher() print(f'[+] Protocol {protocol.name} supported') if protocol in [ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1]: weak_protocols.append(protocol.name) except Exception as e: pass if weak_protocols: print(f'[VULNERABLE] Weak TLS protocols detected: {weak_protocols}') print(f'[!] CVE-2025-12478: Non-compliant TLS configuration confirmed') return True else: print('[-] No weak TLS protocols detected') return False if __name__ == '__main__': if len(sys.argv) > 1: check_tls_vulnerability(sys.argv[1]) else: print('Usage: python cve_2025_12478_poc.py <target_host>')