CVE-2025-14175: TP-Link TL-WR820N SSH服务器弱加密算法漏洞

#!/usr/bin/env python3 """ CVE-2025-14175 PoC - TP-Link TL-WR820N SSH Weak Encryption Note: This PoC is for educational and authorized testing purposes only. """ import socket import sys from paramiko import SSHClient, AutoAddPolicy def check_ssh_weak_encryption(target_ip, port=22): """ Check if target SSH server supports weak encryption algorithms """ print(f"[*] Connecting to {target_ip}:{port}") try: client = SSHClient() client.set_missing_host_key_policy(AutoAddPolicy()) # Try to connect and retrieve server banner sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, port)) banner = sock.recv(256).decode('utf-8', errors='ignore') print(f"[+] SSH Banner: {banner.strip()}") # Send SSH identification string sock.send(b"SSH-2.0-PythonTest\r\n") # Receive server algorithms data = sock.recv(1024) print(f"[*] Server response: {data}") sock.close() # Check for weak algorithms in response weak_algorithms = [b'md5', b'sha1', b'3des', b'rc4', b'arcfour'] for weak_algo in weak_algorithms: if weak_algo in data.lower(): print(f"[!] WARNING: Weak algorithm '{weak_algo.decode()}' detected!") return True except socket.timeout: print("[-] Connection timeout") return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] check_ssh_weak_encryption(target)